CVE-2026-64258 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
If a copy into the userspace ring buffer fails, a request will be terminated and fuse_uring_req_end() will set ent->fuse_req to NULL but it will leave the entry on ent_w_req_queue in FRRS_FUSE_REQ state. This can lead to a NULL deref if the request expiration logic scans ent_w_req_queue in the window before the entry is moved off it.
Fix this by taking the entry off ent_w_req_queue and changing its state from FRRS_FUSE_REQ to FRRS_INVALID before terminating the request.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability described represents a critical null pointer dereference issue within the Linux kernel's fuse-uring subsystem that could potentially lead to system instability or denial of service conditions. This flaw exists in the interaction between the file system overlay mechanism and the io_uring asynchronous I/O framework, specifically affecting how requests are managed during buffer copy operations between kernel and user space contexts.
The technical implementation involves a race condition within the fuse-uring request processing pipeline where the ent_w_req_queue data structure maintains entries in FRRS_FUSE_REQ state even after request termination. When a copy operation into the userspace ring buffer fails, the system correctly sets the fuse_req pointer to NULL within the entry structure but fails to properly remove the entry from the active queue. This partial cleanup creates a scenario where subsequent expiration logic can attempt to dereference the now-null pointer while the entry remains in the queue.
The operational impact of this vulnerability extends beyond simple denial of service, as it represents a fundamental flaw in kernel memory management and state consistency. The issue demonstrates poor error handling in asynchronous I/O processing where cleanup operations are not atomic or complete, creating potential for system crashes or unpredictable behavior when multiple concurrent requests are processed under stress conditions. This vulnerability specifically affects systems utilizing the fuse-uring interface for file system operations and could be exploited by malicious actors to cause system instability.
The fix implemented addresses this by ensuring proper queue management through explicit removal of entries before state transitions occur. The solution requires taking the problematic entry off ent_w_req_queue and changing its state from FRRS_FUSE_REQ to FRRS_INVALID in a coordinated manner that prevents the race condition. This approach aligns with established security practices for kernel memory management and follows principles similar to those recommended in the Common Weakness Enumeration framework under CWE-476, which addresses null pointer dereference vulnerabilities.
The mitigation strategy emphasizes proper state machine transitions and queue management in kernel space operations, which correlates with ATT&CK technique T1548.002 for privilege escalation through kernel exploits. The vulnerability demonstrates how seemingly minor race conditions in asynchronous processing can lead to critical system instability, highlighting the importance of comprehensive testing and validation of kernel subsystems under concurrent load conditions. This fix ensures that all cleanup paths properly account for queue state consistency and prevents the scenario where invalid entries might be processed by expiration logic while holding null references.