PT-2026-64483 · Linux · Linux
CVE-2026-64262
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: end fuse req on io-uring cancel task work
When io uring delivers task work with tw.cancel set (PF EXITING,
PF KTHREAD fallback, or percpu ref is dying on the ring context),
fuse uring send in task() takes the cancel branch, assigns
-ECANCELED, and falls through to fuse uring send(). That path only
flips the entry to FRRS USERSPACE and completes the io uring cmd;
it never discharges the ring entry's owning reference to the
fuse req that fuse uring add req to ring ent() handed it at
dispatch time.
fuse uring send in task()
tw.cancel == true
err = -ECANCELED
fuse uring send(ent, cmd, err, issue flags)
ent->state = FRRS USERSPACE
list move(&ent->list, &queue->ent in userspace)
ent->cmd = NULL
io uring cmd done(-ECANCELED)
/* ent->fuse req still set, req still hashed */
The fuse req stays linked on fpq->processing[hash] and
fuse request end() is never invoked. The originating syscall
thread blocks in D-state in request wait answer() until
fuse abort conn() runs, which can be the entire connection
lifetime. For FR BACKGROUND requests fc->num background is never
decremented either, so repeated cancels inflate the counter until
max background is hit and all later background ops stall. tw.cancel does
not imply a connection abort (e.g. a single io uring worker thread exits
while the fuse connection stays up), so this cannot be left for
fuse abort conn() to clean up.
Ending the req but still routing the entry through fuse uring send()
is not enough: that leaves a req-less entry on ent in userspace, and
ent list request expired() dereferences ent->fuse req unconditionally
on the head of that list, which would then NULL-deref.
Fix the cancel branch to release the entry directly. Remove it from the
queue, complete the io uring cmd, end the fuse req, free the entry, and
drop its queue refs (waking the teardown waiter if it was the last).
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux