CVE-2026-64260 Details
Description
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue->stopped races and set/read that value under lock There are several readers of queue->stopped that check the value under lock, but fuse_uring_commit_fetch() did not and actually the value was not set under the lock in fuse_uring_abort_end_requests() either. Especially in fuse_uring_commit_fetch it is important to check under a lock, because due to races 'struct fuse_req' might be freed with fuse_request_end, but another thread/cpu might already do teardown work.
A race condition vulnerability has been identified in the Linux kernel's fuse-io-uring implementation, specifically in the handling of the queue->stopped variable. This vulnerability exists in the stable branch of the Linux kernel. The issue arises because the fuse_uring_commit_fetch() function does not check the queue->stopped value under a lock, leading to potential data races. As a result, a 'struct fuse_req' could be prematurely freed while another thread is still processing it, causing instability in the system.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. The specific commit that resolves this issue is 39c8e925b207afceffaa5382416ed405e0223a03.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/39c8e925b207afceffaa5382416ed405e0223a03 | kernel.org | Patch |
| https://git.kernel.org/stable/c/4021a3a79eee551d95fe1e1e7c1b195d34ba8c08 | kernel.org | Patch |
| https://git.kernel.org/stable/c/b70a3aca16934c196f92abb17b01c1647b9bb63c | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.14, < 6.18.39 >= 6.19, < 7.1.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 17, 2026 | CVE Modified | kernel.org |
| Aug 12, 2026 | Initial Analysis | [email protected] |
| Jul 27, 2026 | CVE Modified | kernel.org |
| Jul 25, 2026 | New CVE Received | kernel.org |