CVE-2026-64265 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req
When fuse_resend() moves a request from fpq->processing back to fiq->pending, it sets FR_PENDING and clears FR_SENT but does not remove the requests intr_entry from fiq->interrupts. If the request had FR_INTERRUPTED set from a prior signal, intr_entry remains dangling on fiq->interrupts. When the requesting task then receives a fatal signal, fuse_remove_pending_req() sees FR_PENDING=1, removes the request from fiq->pending and frees it via the refcount path, also without cleaning intr_entry. The stale intr_entry causes use-after-free when fuse_read_interrupt() iterates fiq->interrupts: - list_del_init(&req->intr_entry) -> UAF write on freed slab - req->in.h.unique -> UAF read, data leaked to userspace
Remove intr_entry from fiq->interrupts in fuse_resend() for interrupted requests before they are placed back on fiq->pending.
Add a WARN_ON if the intr_entry is not empty on request destruction.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/26/2026
The vulnerability exists within the Linux kernel's fuse filesystem implementation where improper handling of interrupt entries during request resending creates a use-after-free condition that can lead to privilege escalation and data leakage. This flaw specifically affects the interaction between fuse_resend() and fuse_remove_pending_req() functions in the fuse subsystem, which manages communication between user-space applications and kernel-space filesystem operations.
The technical root cause stems from a missing cleanup operation during request state transitions within the fuse framework. When fuse_resend() processes requests that need to be moved from the processing queue back to the pending queue, it correctly sets the FR_PENDING flag and clears the FR_SENT flag but fails to remove the corresponding interrupt entry from the interrupts list. This occurs because interrupted requests that have already been marked with FR_INTERRUPTED retain their intr_entry references in fiq->interrupts even after being requeued. The subsequent removal of these requests through fuse_remove_pending_req() does not clean up the dangling interrupt entries, leaving stale pointers in memory.
The operational impact of this vulnerability manifests when a requesting task receives a fatal signal while holding an interrupted request that has been moved back to the pending state. During cleanup, the system attempts to iterate through fiq->interrupts using fuse_read_interrupt(), which encounters these stale intr_entry references pointing to already-freed memory regions. This results in undefined behavior including use-after-free write operations on freed kernel slab memory and use-after-free read operations that can leak sensitive data to userspace applications. The vulnerability is particularly dangerous as it can be exploited by malicious processes to gain elevated privileges or access confidential information from other processes.
This issue maps directly to CWE-415: Double Free and CWE-416: Use After Free within the Common Weakness Enumeration framework, representing a classic case of improper resource management where memory cleanup operations are not properly synchronized with state transitions. The vulnerability also aligns with ATT&CK technique T1068: Exploitation for Privilege Escalation, as successful exploitation could enable local users to escalate their privileges within the system. The fix implemented addresses this by ensuring that interrupt entries are properly removed from the interrupts list in fuse_resend() before interrupted requests are placed back on the pending queue, preventing the accumulation of stale references.
Security mitigations for this vulnerability include applying the kernel patch that removes intr_entry references during request resending operations and implementing additional runtime checks through the WARN_ON mechanism that alerts administrators when dangling interrupt entries are detected during request destruction. System administrators should prioritize updating to patched kernel versions and monitoring for potential exploitation attempts through unusual patterns of kernel memory access or unexpected system behavior. The fix also strengthens the overall integrity of the fuse subsystem's resource management by ensuring proper cleanup operations occur during all state transitions, reducing attack surface and preventing similar issues from arising in related components of the kernel's filesystem handling infrastructure.