CVE-2026-64263 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: fix moving cancelled entry to ent_in_userspace list
fuse_uring_cancel() moves entries that are available (these have no reqs attached) to the ent_in_userspace list. ent_list_request_expired() checks the first entry on ent_in_userspace and dereferences ent->fuse_req unconditionally, which will crash on a cancelled entry that was moved to this list.
Fix this by freeing the entry and dropping queue_refs directly in fuse_uring_cancel(). This is safe because cancel is the cancel handler itself - after io_uring_cmd_done(), no more cancels will be dispatched for this command, and teardown serializes with cancel via queue->lock.
Since cancel now decrements queue_refs, fuse_uring_abort() must no longer gate fuse_uring_abort_end_requests() on queue_refs > 0, as cancelled entries may have already dropped queue_refs while requests are still queued. Remove the gate so abort always flushes requests and stops queues.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
This vulnerability exists within the Linux kernel's fuse-uring subsystem where a race condition can lead to kernel panic through improper handling of cancelled I/O operations. The issue manifests when the fuse_uring_cancel() function processes entries that have been marked for cancellation but still reside in the ent_in_userspace list. The core technical flaw stems from the assumption that all entries in this list contain valid request structures, while cancelled entries may have been moved to this list without proper cleanup of their associated resources.
The operational impact occurs when ent_list_request_expired() attempts to dereference ent->fuse_req on a cancelled entry that was moved to ent_in_userspace, resulting in a kernel crash due to null pointer dereference. This represents a classic case of improper resource management where the cancellation handler fails to properly clean up entries before moving them between internal lists. The vulnerability aligns with CWE-476 which addresses null pointer dereferences and CWE-362 which covers race conditions in concurrent systems.
The fix implements a direct approach to handle cancelled entries by freeing them and dropping queue_refs directly within the fuse_uring_cancel() function rather than allowing them to remain in the ent_in_userspace list. This solution leverages the fact that cancel operations are handled synchronously through the cancel handler itself, ensuring that no additional cancellation requests will be dispatched after io_uring_cmd_done() completes. The approach also serializes cleanup operations through queue->lock which prevents concurrent access issues during the teardown process.
The mitigation strategy specifically addresses a dependency issue in fuse_uring_abort() where the abort function previously gated its end request processing based on queue_refs > 0. This gate was removed because cancelled entries could have already decremented queue_refs while requests remained queued, creating an inconsistent state that would prevent proper cleanup. The updated implementation ensures that abort operations always flush requests and stop queues regardless of the current queue_ref count, providing a more robust shutdown mechanism for the fuse-uring subsystem.
The solution demonstrates principles consistent with ATT&CK framework's T1068 which covers exploit mitigation through proper resource management and T1499 which addresses system compromise prevention through secure coding practices. This vulnerability highlights the importance of maintaining consistency between internal data structures and their associated resources, particularly in kernel-level code where improper cleanup can lead to system crashes and potential security implications. The fix ensures that all entries in any given list are in a consistent state, preventing the type of null pointer dereference that could be exploited by malicious actors to cause denial of service or potentially escalate privileges through kernel memory corruption.