The vulnerability in the Linux kernel's FUSE subsystem occurs because fuse_resend() moves a request back to the pending queue without removing its interrupt list entry if the request was previously interrupted. Subsequently, fuse_remove_pending_req() frees the request without cleaning up this interrupt entry, resulting in a dangling pointer. When fuse_read_interrupt() iterates over the interrupt list, it performs use-after-free operations, including writing to freed memory and reading unique request identifiers, which can leak kernel data to userspace. The fix involves removing the interrupt entry before placing interrupted requests back on the pending queue and adding a warning if interrupt entries remain on request destruction.

This vulnerability can cause use-after-free conditions in the kernel, leading to potential memory corruption and leakage of kernel data to userspace. While no known exploits are reported, the flaw could be leveraged to compromise kernel integrity or leak sensitive information.

A fix has been implemented in the Linux kernel to properly remove interrupt entries during request resending and removal, preventing use-after-free conditions. Users should apply the official kernel updates that include this patch. Patch status is not explicitly confirmed here; check the vendor advisory for current remediation guidance.