CVE-2026-64263: fuse-uring: fix moving cancelled entry to ent_in_userspace list
In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: fix moving cancelled entry to entinuserspace list
fuseuringcancel() moves entries that are available (these have no reqs attached) to the entinuserspace list. entlistrequestexpired() checks the first entry on entinuserspace and dereferences ent->fusereq unconditionally, which will crash on a cancelled entry that was moved to this list.
Fix this by freeing the entry and dropping queuerefs directly in fuseuringcancel(). This is safe because cancel is the cancel handler itself - after iouringcmddone(), no more cancels will be dispatched for this command, and teardown serializes with cancel via queue->lock.
Since cancel now decrements queuerefs, fuseuringabort() must no longer gate fuseuringabortendrequests() on queuerefs > 0, as cancelled entries may have already dropped queuerefs while requests are still queued. Remove the gate so abort always flushes requests and stops queues.
Affected Software
Remediation
Event History
Frequently Asked Questions
What level of access does an attacker need?
Exploitation requires local access and low privileges; the CVSS vector does not indicate a network or user-interaction requirement. The affected path involves FUSE io_uring command cancellation and can result in a kernel crash, causing denial of service.
What condition triggers the failure?
The issue is triggered when a cancelled FUSE io_uring entry without an attached request is moved to the ent_in_userspace list, where later processing dereferences its missing fuse_req. This can crash the kernel.
What is the remediation?
Apply an available kernel patch. The supplied stable references identify patches for this issue.