SLUB

struct fuse_req holds inode references without bumping i_count. SIGKILL a stalled reader, trigger drop_caches inode eviction, delay fuse_abort_conn — the freed slab slot gets reallocated as struct cred. The race delivers a refcount double-decrement on whatever credential lands there: full DirtyCred-class LPE primitive. Complete race window analysis, SLUB reallocation timing, and RCU lifetime breakdown.

FUSE daemons control filesystem metadata returned to the kernel via vfs_getattr — including i_size. Setting i_size to an inflated value desynchronizes the kernel’s allocation (kmalloc based on reported size) from its ingestion (copy_from_user of actual bytes), creating a heap under-allocation. kernel_read_file() callers — finit_module(2), firmware loader, kexec_file_load(2) — are turned into kmalloc-4k SLUB slab overflow primitives. VFS trust inversion architecture, TOCTOU window analysis, and virtio-fs shared-memory attack surface covered.