CVE-2026-64262 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: end fuse_req on io-uring cancel task work
When io_uring delivers task work with tw.cancel set (PF_EXITING, PF_KTHREAD fallback, or percpu_ref_is_dying on the ring context), fuse_uring_send_in_task() takes the cancel branch, assigns -ECANCELED, and falls through to fuse_uring_send(). That path only flips the entry to FRRS_USERSPACE and completes the io_uring cmd; it never discharges the ring entry's owning reference to the fuse_req that fuse_uring_add_req_to_ring_ent() handed it at dispatch time.
fuse_uring_send_in_task() tw.cancel == true err = -ECANCELED fuse_uring_send(ent, cmd, err, issue_flags) ent->state = FRRS_USERSPACE list_move(&ent->list, &queue->ent_in_userspace) ent->cmd = NULL io_uring_cmd_done(-ECANCELED) /* ent->fuse_req still set, req still hashed */
The fuse_req stays linked on fpq->processing[hash] and
fuse_request_end() is never invoked. The originating syscall thread blocks in D-state in request_wait_answer() until fuse_abort_conn() runs, which can be the entire connection lifetime. For FR_BACKGROUND requests fc->num_background is never decremented either, so repeated cancels inflate the counter until max_background is hit and all later background ops stall. tw.cancel does not imply a connection abort (e.g. a single io_uring worker thread exits while the fuse connection stays up), so this cannot be left for fuse_abort_conn() to clean up.
Ending the req but still routing the entry through fuse_uring_send() is not enough: that leaves a req-less entry on ent_in_userspace, and ent_list_request_expired() dereferences ent->fuse_req unconditionally on the head of that list, which would then NULL-deref.
Fix the cancel branch to release the entry directly. Remove it from the queue, complete the io_uring cmd, end the fuse_req, free the entry, and drop its queue_refs (waking the teardown waiter if it was the last).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/26/2026
This vulnerability exists within the Linux kernel's fuse-uring implementation where a race condition occurs during io_uring task work cancellation that leads to resource leaks and potential system instability. The issue manifests when io_uring delivers task work with the cancel flag set, triggering a specific code path in fuse_uring_send_in_task() that assigns -ECANCELED but fails to properly clean up the associated fuse request structure. This flaw directly relates to CWE-404, which describes improper resource management where resources are not properly released after use.
The technical implementation flaw occurs because when tw.cancel is true, the code correctly sets err = -ECANCELED and calls fuse_uring_send(), but this function only transitions the entry state to FRRS_USERSPACE and completes the io_uring command without releasing the owning reference to the fuse_req. The fuse request remains linked in the processing queue fpq->processing[hash] and fuse_request_end() is never invoked, creating a persistent resource leak that can continue indefinitely until explicit connection abort occurs. This behavior represents a violation of proper resource lifecycle management principles and directly impacts system stability under sustained cancellation conditions.
The operational impact of this vulnerability is significant as it causes blocking behavior in the originating syscall thread that remains in D-state within request_wait_answer() until fuse_abort_conn() executes, potentially lasting the entire connection lifetime. Additionally, for background requests, the fc->num_background counter is never decremented during cancellation, leading to counter inflation that eventually prevents new background operations from executing when max_background limit is reached. This creates a denial of service condition where legitimate operations stall indefinitely while the system continues to track cancelled requests in memory.
The fix addresses this issue by modifying the cancel branch logic to properly release the entry directly rather than simply routing it through fuse_uring_send(). The corrected implementation removes the entry from its queue, completes the io_uring command, ends the fuse request, frees the entry, and drops its queue references while waking any teardown waiters if applicable. This solution aligns with ATT&CK technique T1490, which covers resource exhaustion attacks, by ensuring proper cleanup during cancellation operations. The fix ensures that all references are properly released and prevents both memory leaks and the potential for NULL dereference conditions in subsequent processing paths.
This vulnerability demonstrates a classic example of improper reference counting in kernel space where the fuse subsystem fails to maintain proper accounting of request references during asynchronous cancellation scenarios. The implementation relies on io_uring's task work mechanism but does not account for all possible cancellation pathways, particularly when the cancellation occurs at different points in the request lifecycle. The fix ensures that all resource management operations occur atomically and that no references remain dangling after cancellation, preventing both immediate resource exhaustion and long-term memory corruption scenarios.
The solution follows established kernel development practices for managing asynchronous operations where all resources must be properly accounted for regardless of execution path taken through the code. This particular implementation follows the principle of least privilege and proper resource cleanup that should be enforced in all kernel subsystems handling asynchronous I/O operations. The vulnerability highlights the complexity of managing reference counts across multiple subsystem boundaries and demonstrates why careful attention to resource lifecycle management is essential in kernel space programming where improper cleanup can lead to system instability and denial of service conditions.