CVE-2026-64260: fuse-uring: Avoid queue->stopped races and set/read that value under lock
In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: Avoid queue->stopped races and set/read that value under lock
There are several readers of queue->stopped that check the value under lock, but fuseuringcommitfetch() did not and actually the value was not set under the lock in fuseuringabortendrequests() either. Especially in fuseuringcommitfetch it is important to check under a lock, because due to races 'struct fusereq' might be freed with fuserequestend, but another thread/cpu might already do teardown work.
Affected Software
Remediation
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What is the potential impact if exploitation succeeds?
The issue is rated high severity with a 7.8 CVSS score. It can affect confidentiality, integrity, and availability at a high level.
What should teams do if they use the affected kernel component?
Apply an available patch. The listed stable kernel commits provide the fix for the queue->stopped locking race.