CVE-2026-64265 Details
Description
In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req When fuse_resend() moves a request from fpq->processing back to fiq->pending, it sets FR_PENDING and clears FR_SENT but does not remove the requests intr_entry from fiq->interrupts. If the request had FR_INTERRUPTED set from a prior signal, intr_entry remains dangling on fiq->interrupts. When the requesting task then receives a fatal signal, fuse_remove_pending_req() sees FR_PENDING=1, removes the request from fiq->pending and frees it via the refcount path, also without cleaning intr_entry. The stale intr_entry causes use-after-free when fuse_read_interrupt() iterates fiq->interrupts: - list_del_init(&req->intr_entry) -> UAF write on freed slab - req->in.h.unique -> UAF read, data leaked to userspace Remove intr_entry from fiq->interrupts in fuse_resend() for interrupted requests before they are placed back on fiq->pending. Add a WARN_ON if the intr_entry is not empty on request destruction.
A use-after-free vulnerability has been identified in the FUSE (Filesystem in Userspace) subsystem of the Linux kernel. This issue arises when the `fuse_resend()` function moves a request from the processing queue back to the pending queue. While it correctly updates the request's status, it fails to remove the interrupt entry from the interrupt list. If the request was previously interrupted by a signal, this oversight leaves a dangling entry. When the task receives a fatal signal, the `fuse_remove_pending_req()` function removes the request from the pending queue and frees it, but does not clean up the interrupt entry. This stale entry causes a use-after-free condition when `fuse_read_interrupt()` processes the interrupt list, leading to a write on a freed memory slab and a read of freed data, which is then leaked to userspace.
The vulnerability has been addressed in the official Linux Git repository. Users should upgrade to the latest version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/1d8ecd0cd696a5df0b2f72046a4ccee5d2a8ec2c | kernel.org | Patch |
| https://git.kernel.org/stable/c/7366e6f4d2b4c7002b13fb01219e83679dad4127 | kernel.org | Patch |
| https://git.kernel.org/stable/c/893479015cb6442fd389d3b553ab3036c9541715 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f8fce75fedf73ac72aa09163deb8f4291fdcaad2 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.9, < 6.12.96 >= 6.13, < 6.18.39 >= 6.19, < 7.1.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 17, 2026 | CVE Modified | kernel.org |
| Aug 12, 2026 | Initial Analysis | [email protected] |
| Jul 27, 2026 | CVE Modified | kernel.org |
| Jul 25, 2026 | New CVE Received | kernel.org |