CVE-2026-64259

Analyzed Analyzed - Analysis Complete

Race Condition in Linux Kernel fuse-uring

Publication date: 2026-07-25

Last updated on: 2026-08-12

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse_req on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server (io_uring_cmd_done() not called) yet. fuse_uring_commit_fetch() ends the fuse request when the ring entry has a wrong state, but that could have caused a use-after-free with the memcpy operations in fuse_uring_send_in_task(). In order to avoid such races the call of fuse_uring_add_to_pq() is moved after the copy operations and just before completing the io-uring request - malicious userspace cannot find the request anymore until all prepration work in fuse-client/kernel is completed. This also moves fuse_uring_add_to_pq() a bit up in the code to avoid a forward declaration. Also not with a preparation commit, to make it easier to back port to older kernels.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-12

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64259

EUVD

EUVD-2026-48971

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 6.14 (inc) to 6.18.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the fuse-uring component. It involves a race condition where malicious userspace code could trick the kernel into accessing freed memory during operations involving io_uring commands. The issue occurs when a request is committed but not yet processed, leading to potential use-after-free scenarios during memcpy operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's fuse-uring implementation and requires kernel-level detection. No direct network detection commands are available. Monitor kernel logs for fuse-related errors or crashes after applying updates. Check for unusual io_uring or fuse subsystem behavior using kernel debugging tools like ftrace or perf.

Impact Analysis

This vulnerability could allow an attacker with local access to cause system crashes, data corruption, or potentially execute arbitrary code in the kernel context. It may lead to privilege escalation if exploited successfully.

Compliance Impact

This vulnerability is a low-level Linux kernel issue related to memory management in the fuse-uring subsystem. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than kernel memory handling.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this vulnerability. Monitor kernel security advisories and apply updates promptly.

Hi! I’m here to help you understand CVE-2026-64259. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70