CVE-2026-64266

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel FUSE

Publication date: 2026-07-25

Last updated on: 2026-08-12

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_ref_folio() fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async end callback (eg fuse_writepage_free()) can free the args while the subsequent copy chain logic after fuse_ref_folio() accesses them, leading to use-after-free issues. Fix this by locking the request in fuse_ref_folio() before returning.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-12

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64266

EUVD

EUVD-2026-48978

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.11 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 2.6.35 (inc) to 5.10.261 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the fuse_ref_folio() function. The function unlocks a request but fails to re-lock it before returning. This allows fuse_chan_abort() to end the request and trigger an async end callback, which may free memory while the subsequent logic still tries to access it. This leads to a use-after-free issue.

Detection Guidance

This vulnerability is specific to the Linux kernel's FUSE (Filesystem in Userspace) implementation and requires kernel-level inspection. Detection involves checking kernel logs for fuse-related errors or crashes, particularly after file operations. Commands like dmesg | grep fuse or journalctl -k | grep fuse may reveal issues. However, no direct detection commands are provided in the CVE details.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by triggering a use-after-free condition. It may lead to system crashes, data corruption, or unauthorized access depending on the kernel's state when exploited.

Compliance Impact

This vulnerability involves a use-after-free issue in the Linux kernel's FUSE (Filesystem in Userspace) component due to improper locking and unlocking of requests. While it does not directly impact compliance with standards like GDPR or HIPAA, such memory corruption vulnerabilities could potentially lead to unauthorized data access or system instability if exploited. This may indirectly affect compliance by compromising data integrity or availability.

Mitigation Strategies

Update your Linux kernel to the latest patched version to address the fuse_ref_folio use-after-free vulnerability.

Hi! I’m here to help you understand CVE-2026-64266. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70