CVE-2026-64266: fuse: re-lock request before returning from fuse_ref_folio()
fuse: re-lock request before returning from fusereffolio()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1 - Compensating control
Lock the request in fuse_ref_folio() before returning, so subsequent copy-chain logic cannot access a request freed by fuse_chan_abort() and the asynchronous end callback.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64266?
CVE-2026-64266 has a high severity rating of 7.8 on the CVSS scale.
How do I fix CVE-2026-64266?
You can fix CVE-2026-64266 by applying the available patch provided by the Linux kernel.
What type of vulnerability is CVE-2026-64266?
CVE-2026-64266 is classified as a Use After Free vulnerability within the Linux kernel.
Which software is affected by CVE-2026-64266?
CVE-2026-64266 affects the Linux kernel, including specific versions from Microsoft azl3 kernel.
When was CVE-2026-64266 published?
CVE-2026-64266 was published on July 25, 2026.