CVE-2026-64258
Received Received - Intake

FUSE-uring NULL Dereference in Linux Kernel

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuse_uring_req_end() will set ent->fuse_req to NULL but it will leave the entry on ent_w_req_queue in FRRS_FUSE_REQ state. This can lead to a NULL deref if the request expiration logic scans ent_w_req_queue in the window before the entry is moved off it. Fix this by taking the entry off ent_w_req_queue and changing its state from FRRS_FUSE_REQ to FRRS_INVALID before terminating the request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64258
EUVD
EUVD-2026-48970

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's fuse-uring component. When a copy to the userspace ring buffer fails, a request is terminated and the entry's fuse_req is set to NULL but remains on ent_w_req_queue in FRRS_FUSE_REQ state. This can cause a crash if the request expiration logic scans the queue before the entry is removed.

Impact Analysis

This vulnerability could cause system crashes or instability in systems using fuse-uring, potentially leading to denial of service. It may affect applications relying on FUSE (Filesystem in Userspace) for file operations.

Mitigation Strategies

Update the Linux kernel to the patched version that includes the fix for the fuse-uring NULL dereference vulnerability. Monitor system logs for NULL dereference errors related to fuse-uring operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64258. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart