Race-Condition

struct fuse_req holds inode references without bumping i_count. SIGKILL a stalled reader, trigger drop_caches inode eviction, delay fuse_abort_conn — the freed slab slot gets reallocated as struct cred. The race delivers a refcount double-decrement on whatever credential lands there: full DirtyCred-class LPE primitive. Complete race window analysis, SLUB reallocation timing, and RCU lifetime breakdown.

udisks2 handles XFS resize via temporary /tmp/blockdev.XXXXXX mount points. Between mount creation and nosuid application, a race window allows SUID binary execution. Three-stage exploit: Polkit bypass via ~/.pam_environment local seat0 session spoofing, XFS image crafting with pwnbash SUID binary baked into mkfs.xfs Protofile metadata, D-Bus resize request flood to continuously recreate race window. Architecture-agnostic (x86/x64/ARM). Confirmed LPE on openSUSE Leap 15.6 kernel 6.4.0.