CVE-2026-80858: linux

CVSS: UnknownReceived
AliasesUBUNTU-CVE-2026-80858DEBIAN-CVE-2026-80858
Published 04-09-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-80858 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 4.2% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.15%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:11773-1

Timeline

  1. 04-09-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: fuse: publish io-uring queues with release semantics fuse_uring_create_queue() initializes a fuse_ring_queue and then publishes the pointer into ring->queues[qid] with WRITE_ONCE() under the fch->lock. There are several readers that may concurrently be fetching that pointer locklessly and then deferencing it. WRITE_ONCE() doesn't ensure ordering of the queue's field initialization before the ring->queues[qid] pointer assignment. The queue must be published with smp_store_release() so the field initialization is guaranteed to happen before. Readers in paths where the read may happen concurrently with the store need to use READ_ONCE() because any race involving a plain access is undefined.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.15%

Chance of exploitation in the next 30 days

Percentile

4%

Versus all other CVEs

30-day change

0.00 pp

From 0.15% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.15%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu120 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 7.2.6-1
Linux1 product
  • linux≥ 24fe962c86f55347385933a1b06ca71b60854690, < a5bb215dbc34b4c6a5e144ea1416bf66450d519f | ≥ 24fe962c86f55347385933a1b06ca71b60854690, < a1bb359c443d048fe5dfd6ca9caf4e3897f3e9aa | ≥ 24fe962c86f55347385933a1b06ca71b60854690, < 42df916e5a5f8fb4b60c8cefb54318d1ec02c580 | 6.14

3 vendors · 122 products

References

7 links