CVE-2026-64261: fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: Avoid use-after-free in fuseuringasyncstopqueues
fuseuringasyncstopqueues() might run when the last reference on ring->queuerefs was already dropped.
In order to avoid an early destruction a reference on struct fuseconn is now taken before starting fuseuringasyncstopqueues() and that reference is only released when that delayed work queue terminates.
Affected Software
Remediation
Event History
Frequently Asked Questions
What level of access does an attacker need?
Exploitation requires local access and low privileges. No user interaction is required.
What impact could successful exploitation have?
The CVSS vector indicates high impact to confidentiality, integrity, and availability within the affected security scope.
What should administrators do if they use the affected kernel component?
Apply an available patch. The fix holds a fuse_conn reference while the delayed fuse_uring_async_stop_queues work is running, preventing premature destruction.