The vulnerability in the Linux kernel fuse-uring subsystem was due to fuse_uring_cancel() moving cancelled entries (which have no requests attached) to the ent_in_userspace list. The ent_list_request_expired() function then dereferenced ent->fuse_req unconditionally, leading to a crash when the entry was cancelled and moved to this list. The fix frees the entry and drops queue references directly in fuse_uring_cancel(), ensuring safe cancellation handling. Additionally, fuse_uring_abort() was modified to always flush requests and stop queues without gating on queue_refs, addressing the changed reference counting behavior.

This vulnerability could cause the Linux kernel to crash due to dereferencing invalid memory when processing cancelled fuse-uring entries. Such crashes can lead to denial of service conditions on affected systems. There is no indication of code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to address this issue by properly freeing cancelled entries and adjusting reference counts. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the current remediation guidance.