PT-2026-64486 · Linux · Linux

CVE-2026-64265 · Published 2026-07-25 · Updated 2026-07-25

Mitre

In the Linux kernel, the following vulnerability has been resolved:

fuse: clear intr entry in fuse resend and fuse remove pending req

When fuse resend() moves a request from fpq->processing back to fiq->pending, it sets FR PENDING and clears FR SENT but does not remove the requests intr entry from fiq->interrupts. If the request had FR INTERRUPTED set from a prior signal, intr entry remains dangling on fiq->interrupts. When the requesting task then receives a fatal signal, fuse remove pending req() sees FR PENDING=1, removes the request from fiq->pending and frees it via the refcount path, also without cleaning intr entry. The stale intr entry causes use-after-free when fuse read interrupt() iterates fiq->interrupts:

• list del init(&req->intr entry) -> UAF write on freed slab
• req->in.h.unique -> UAF read, data leaked to userspace

Remove intr entry from fiq->interrupts in fuse resend() for interrupted requests before they are placed back on fiq->pending.

Add a WARN ON if the intr entry is not empty on request destruction.

Related Identifiers

CVE-2026-64265

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-64265 · Security Note
• https://git.kernel.org/stable/c/f8fce75fedf73ac72aa09163deb8f4291fdcaad2 · Note
• https://git.kernel.org/stable/c/893479015cb6442fd389d3b553ab3036c9541715 · Note
• https://git.kernel.org/stable/c/1d8ecd0cd696a5df0b2f72046a4ccee5d2a8ec2c · Note
• https://git.kernel.org/stable/c/7366e6f4d2b4c7002b13fb01219e83679dad4127 · Note