CVE-2026-64266 Details
Description
In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_ref_folio() fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async end callback (eg fuse_writepage_free()) can free the args while the subsequent copy chain logic after fuse_ref_folio() accesses them, leading to use-after-free issues. Fix this by locking the request in fuse_ref_folio() before returning.
A use-after-free vulnerability has been identified in the Linux kernel's FUSE (Filesystem in Userspace) implementation. The issue arises in the function 'fuse_ref_folio()', which fails to re-lock a request before returning. This oversight can be exploited, as 'fuse_chan_abort()' may terminate the request, and the asynchronous callback (such as 'fuse_writepage_free()') can deallocate the arguments. Subsequently, the copy chain logic following 'fuse_ref_folio()' may access these freed arguments, leading to use-after-free conditions.
The vulnerability has been fixed by modifying 'fuse_ref_folio()' to re-lock the request before returning. Users should upgrade to the latest version of the Linux kernel where this fix has been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0e4a5a000123d81234e27a2f8187688cf608f755 | kernel.org | Patch |
| https://git.kernel.org/stable/c/1ca605cfa59377f0143fb35b5b01360f37d1b7c4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/1f9156714592356b4fda57beac7eab9c2a462dd3 | kernel.org | Patch |
| https://git.kernel.org/stable/c/5630da218a45ba80f0aba0846cbe8aa655da122b | kernel.org | Patch |
| https://git.kernel.org/stable/c/65a1c2551f7e16085acbb54aedde1feaa559ba7a | kernel.org | Patch |
| https://git.kernel.org/stable/c/b5befa80fdbe287a98480effed9564712924add5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/be353caffa8640f5e25fb3714ce8b0cef5e410e5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e6aa539720c3d8def69683ed0c07cf9faea4e8be | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.35, < 5.10.261 >= 5.11, < 5.15.212 >= 5.16, < 6.1.178 >= 6.2, < 6.6.145 >= 6.7, < 6.12.96 >= 6.13, < 6.18.39 >= 6.19, < 7.1.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 17, 2026 | CVE Modified | kernel.org |
| Aug 12, 2026 | Initial Analysis | [email protected] |
| Jul 27, 2026 | CVE Modified | kernel.org |
| Jul 25, 2026 | New CVE Received | kernel.org |