The Linux kernel fuse-uring subsystem had a flaw where, if copying data into the userspace ring buffer failed, the associated request was terminated and its fuse_req pointer set to NULL, but the entry remained on the ent_w_req_queue in a state indicating a valid request. This could cause a NULL pointer dereference when the request expiration logic scanned the queue before the entry was removed. The fix involves removing the entry from ent_w_req_queue and changing its state to invalid before terminating the request, preventing the NULL dereference.

This vulnerability could cause a NULL pointer dereference in the Linux kernel, potentially leading to a kernel crash or denial of service. There is no indication of code execution or privilege escalation from the provided information. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to address this issue by removing request-less entries from the ent_w_req_queue and updating their state before termination. Users should apply the official kernel updates that include this fix once available. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.