The vulnerability in the Linux kernel fuse-uring subsystem occurs when io_uring delivers task work with the cancel flag set. The cancellation branch in fuse_uring_send_in_task() assigns an error code and calls fuse_uring_send(), which completes the io_uring command but fails to release the owning reference to the fuse_req. This causes the fuse_req to remain linked and the originating syscall thread to block indefinitely in a D-state waiting for a response that never arrives. Additionally, background request counters are not decremented, leading to stalls in background operations. The fix modifies the cancellation path to properly release the entry by removing it from the queue, completing the io_uring command, ending the fuse_req, freeing the entry, and dropping queue references, thus preventing resource leaks and deadlocks.

The improper cleanup of canceled io_uring requests in fuse-uring can cause syscall threads to block indefinitely, leading to resource exhaustion and stalling of background operations on the affected system. This can degrade system stability and performance, potentially causing denial of service conditions related to the fuse filesystem operations. There is no indication of remote code execution or privilege escalation from the provided data.

A fix for this vulnerability has been implemented in the Linux kernel. Since no explicit patch links or vendor advisory are provided, check the official Linux kernel repositories or vendor advisories for the relevant patch and update to a fixed kernel version. Until patched, affected systems may experience blocking and stalling issues related to fuse-uring cancellations.