PT-2026-64481 · Linux · Linux

CVE-2026-64260 · Published 2026-07-25 · Updated 2026-07-25

Mitre

In the Linux kernel, the following vulnerability has been resolved:

fuse-uring: Avoid queue->stopped races and set/read that value under lock

There are several readers of queue->stopped that check the value under lock, but fuse uring commit fetch() did not and actually the value was not set under the lock in fuse uring abort end requests() either. Especially in fuse uring commit fetch it is important to check under a lock, because due to races 'struct fuse req' might be freed with fuse request end, but another thread/cpu might already do teardown work.

Related Identifiers

CVE-2026-64260

Affected Products

Linux

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-64260 · Security Note
• https://git.kernel.org/stable/c/4021a3a79eee551d95fe1e1e7c1b195d34ba8c08 · Note
• https://git.kernel.org/stable/c/b70a3aca16934c196f92abb17b01c1647b9bb63c · Note
• https://git.kernel.org/stable/c/39c8e925b207afceffaa5382416ed405e0223a03 · Note