CVE-2026-64263: fuse-uring: fix moving cancelled entry to ent_in_userspace list

Published Jul 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

fuse-uring: fix moving cancelled entry to entinuserspace list

fuseuringcancel() moves entries that are available (these have no reqs attached) to the entinuserspace list. entlistrequestexpired() checks the first entry on entinuserspace and dereferences ent->fusereq unconditionally, which will crash on a cancelled entry that was moved to this list.

Fix this by freeing the entry and dropping queuerefs directly in fuseuringcancel(). This is safe because cancel is the cancel handler itself - after iouringcmddone(), no more cancels will be dispatched for this command, and teardown serializes with cancel via queue->lock.

Since cancel now decrements queuerefs, fuseuringabort() must no longer gate fuseuringabortendrequests() on queuerefs > 0, as cancelled entries may have already dropped queuerefs while requests are still queued. Remove the gate so abort always flushes requests and stops queues.

Affected Software

3 affected components
Linux Kernel
Linux Linux kernel>=6.16<6.18.39
Linux Linux kernel>=6.19<7.1.4

Event History

Jul 25, 2026
CVE Published
via MITRE·08:49 AM
Data Sourced
via MITRE·08:49 AM
Description
Data Sourced
via NVD·10:17 AM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What level of access does an attacker need?

Exploitation requires local access and low privileges; the CVSS vector does not indicate a network or user-interaction requirement. The affected path involves FUSE io_uring command cancellation and can result in a kernel crash, causing denial of service.

2

What condition triggers the failure?

The issue is triggered when a cancelled FUSE io_uring entry without an attached request is moved to the ent_in_userspace list, where later processing dereferences its missing fuse_req. This can crash the kernel.

3

What is the remediation?

Apply an available kernel patch. The supplied stable references identify patches for this issue.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203