{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  fuse: fix missing barrier when checking io-uring readiness  fuse_block_alloc() reads fch-\u003einitialized and then fch-\u003eio_uring. fch-\u003eio_uring is set before fch-\u003einitialized, ordered by the smp_wmb() in fuse_chan_set_intialized(), but fuse_block_alloc() has no matching read barrier between the two loads.  This may lead a CPU to observe fch-\u003einitialized=1 but fch-\u003eio_uring=0, and skip the check that blocks request allocation until the io-uring queues are ready. This can reintroduce the lock-order inversion deadlock that commit 3393ff964e0f prevents.  Add an smp_rmb() barrier to pair with the smp_wmb() in fuse_chan_set_initialized() to prevent this.",
  "id": "DEBIAN-CVE-2026-80859",
  "modified": "2026-09-23T03:47:37.458564467Z",
  "published": "2026-09-04T16:18:15.070Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-80859"
    }
  ],
  "upstream": [
    "CVE-2026-80859"
  ]
}