CVE-2026-64258

Analyzed Analyzed - Analysis Complete

FUSE-uring NULL Dereference in Linux Kernel

Publication date: 2026-07-25

Last updated on: 2026-08-12

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuse_uring_req_end() will set ent->fuse_req to NULL but it will leave the entry on ent_w_req_queue in FRRS_FUSE_REQ state. This can lead to a NULL deref if the request expiration logic scans ent_w_req_queue in the window before the entry is moved off it. Fix this by taking the entry off ent_w_req_queue and changing its state from FRRS_FUSE_REQ to FRRS_INVALID before terminating the request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-12

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64258

EUVD

EUVD-2026-48970

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 6.16 (inc) to 6.18.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's fuse-uring component. When a copy to the userspace ring buffer fails, a request is terminated and the entry's fuse_req is set to NULL but remains on ent_w_req_queue in FRRS_FUSE_REQ state. This can cause a crash if the request expiration logic scans the queue before the entry is removed.

Detection Guidance

This vulnerability is specific to the Linux kernel's fuse-uring component and requires kernel-level inspection. Detection involves checking for NULL dereference conditions in the fuse_uring subsystem. Monitor kernel logs for fuse-related errors or crashes, particularly during I/O operations involving the userspace ring buffer. Use commands like dmesg | grep -i fuse or journalctl -k | grep -i fuse to inspect kernel messages for anomalies.

Impact Analysis

This vulnerability could cause system crashes or instability in systems using fuse-uring, potentially leading to denial of service. It may affect applications relying on FUSE (Filesystem in Userspace) for file operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue involving a NULL dereference in the fuse-uring subsystem, which could lead to system instability or crashes but does not involve data breaches or unauthorized access.

Mitigation Strategies

Update the Linux kernel to the patched version that includes the fix for the fuse-uring NULL dereference vulnerability. Monitor system logs for NULL dereference errors related to fuse-uring operations.

Hi! I’m here to help you understand CVE-2026-64258. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70