PT-2026-64484 · Linux · Linux
CVE-2026-64263
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: fix moving cancelled entry to ent in userspace list
fuse uring cancel() moves entries that are available (these have no reqs
attached) to the ent in userspace list. ent list request expired()
checks the first entry on ent in userspace and dereferences
ent->fuse req unconditionally, which will crash on a cancelled entry
that was moved to this list.
Fix this by freeing the entry and dropping queue refs directly in
fuse uring cancel(). This is safe because cancel is the cancel handler
itself - after io uring cmd done(), no more cancels will be dispatched
for this command, and teardown serializes with cancel via queue->lock.
Since cancel now decrements queue refs, fuse uring abort() must no
longer gate fuse uring abort end requests() on queue refs > 0, as
cancelled entries may have already dropped queue refs while requests are
still queued. Remove the gate so abort always flushes requests and stops
queues.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux