This vulnerability in the Linux kernel fuse-uring subsystem arises from improper synchronization when accessing the queue->stopped flag. While several readers check this flag under lock, fuse_uring_commit_fetch() did not, and fuse_uring_abort_end_requests() also failed to set it under lock. This race condition could lead to a 'struct fuse_req' being freed by one thread while another thread is concurrently performing teardown work, potentially causing memory corruption or other critical impacts. The issue has been resolved by modifying the code to always set and read queue->stopped under lock, preventing these race conditions.

The vulnerability allows local attackers with limited privileges to exploit race conditions in the fuse-uring subsystem, potentially leading to memory corruption, denial of service, or privilege escalation due to use-after-free scenarios. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability, but requires local access and low complexity.

A fix has been implemented in the Linux kernel to address this race condition by enforcing locking around queue->stopped accesses. Users should apply the official kernel updates or patches provided by their Linux distribution to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying these updates locally. No known exploits are reported in the wild at this time.