ZDI-26-681: Linux Kernel FUSE Subsystem Race Condition Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-64265.
Affected Software
Event History
Frequently Asked Questions
Can this be exploited remotely without first gaining access to the system?
The available information describes this as a local privilege-escalation issue. Exploitation requires the attacker to already be able to execute low-privileged code on the target system.
Which Linux Kernel versions are affected?
The provided information identifies Linux Kernel as the affected software but does not list affected or fixed versions.
Is a mitigation available if patching cannot be performed immediately?
No workaround or mitigation is specified in the provided information. Limiting untrusted users' ability to execute code locally would address the stated exploitation prerequisite.
What identifier should be used to track this vulnerability?
Track the issue as CVE-2026-64265. The advisory also assigns it a CVSS score of 7.8.