CVE-2026-64588: fuse-uring: fix data races on ring->ready
In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: fix data races on ring->ready
On weakly-ordered architectures, the store to fiq->ops can be reordered past the store to ring->ready, allowing a CPU that sees ring->ready == true via fuseuringready() to dispatch requests through a stale fiq->ops pointer. Upgrade the store to smpstorerelease() and the load in fuseuringready() to smploadacquire() so that the preceding WRITEONCE(fiq->ops, ...) is visible to any CPU that observes ring->ready == true.
Additionally, fuseuringdoregister() publishes ring->ready with WRITEONCE() but the fast-path check reads it with a plain load. This is a marked-vs-unmarked access that KCSAN will flag. Wrap it in READONCE() to mark it without adding unnecessary ordering.
Also wrap the fc->ring load in fuseuringready() in READONCE() to prevent the compiler from reloading it between the NULL check and the dereference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the fuse-uring patch behavior: (1) wrap fc->ring load in fuse_uring_ready() with READ_ONCE(); (2) mark the store to ring->ready using WRITE_ONCE() instead of a plain store; (3) in fuse_uring_ready() read with dereference() so marked-vs-unmarked access is consistent and KCSAN does not flag it; (4) use smp_store_release() when publishing WRITE_ONCE(fiq->ops, ...) and smp_load_acquire() in fuse_uring_ready() to ensure the fast-path NULL check/load cannot be reordered past the release store, preventing stale fiq->ops pointer dispatch.
Linux kernel (fuse-uring) Use READ_ONCE() / WRITE_ONCE() / dereference() for marked-vs-unmarked access and ring->ready publication = Ensure ring->ready and fiq->ops accesses use READ_ONCE(), WRITE_ONCE(), and dereference() as described to fix data races and ordering
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64588?
The severity of CVE-2026-64588 is rated at 23, indicating it poses a significant risk.
How do I fix CVE-2026-64588?
To resolve CVE-2026-64588, update the Linux kernel to the latest version that includes the patch for this vulnerability.
What type of vulnerability is CVE-2026-64588?
CVE-2026-64588 is a data race vulnerability in the Linux kernel related to the fuse-uring subsystem.
What systems are affected by CVE-2026-64588?
CVE-2026-64588 affects the Linux kernel versions that utilize the fuse-uring feature.
What could happen if CVE-2026-64588 is exploited?
If exploited, CVE-2026-64588 could lead to unexpected behavior in the processing of requests within the fuse-uring subsystem.