PT-2026-64484 · Linux · Linux
CVE-2026-64263
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: fix moving cancelled entry to ent in userspace list
fuse uring cancel() moves entries that are available (these have no reqs
attached) to the ent in userspace list. ent list request expired()
checks the first entry on ent in userspace and dereferences
ent->fuse req unconditionally, which will crash on a cancelled entry
that was moved to this list.
Fix this by freeing the entry and dropping queue refs directly in
fuse uring cancel(). This is safe because cancel is the cancel handler
itself - after io uring cmd done(), no more cancels will be dispatched
for this command, and teardown serializes with cancel via queue->lock.
Since cancel now decrements queue refs, fuse uring abort() must no
longer gate fuse uring abort end requests() on queue refs > 0, as
cancelled entries may have already dropped queue refs while requests are
still queued. Remove the gate so abort always flushes requests and stops
queues.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux