CVE-2026-64266 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
fuse: re-lock request before returning from fuse_ref_folio()
fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async end callback (eg fuse_writepage_free()) can free the args while the subsequent copy chain logic after fuse_ref_folio() accesses them, leading to use-after-free issues.
Fix this by locking the request in fuse_ref_folio() before returning.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability identified in the Linux kernel's FUSE implementation represents a critical use-after-free condition that arises from improper locking behavior within the fuse_ref_folio() function. This flaw exists within the FUSE (Filesystem in Userspace) subsystem which provides a mechanism for userspace programs to implement filesystems without modifying kernel code directly. The issue stems from a fundamental race condition where the function unlocks a request structure but fails to reacquire the lock before returning control flow to calling code.
The technical root cause lies in the sequence of operations within the FUSE driver's request handling logic. When fuse_ref_folio() executes, it releases the lock protecting the request structure, allowing other concurrent threads or asynchronous callbacks to potentially manipulate or terminate the same request. The subsequent execution path includes a call to fuse_chan_abort() which may forcibly end the request processing, while async completion callbacks such as fuse_writepage_free() can proceed to free memory resources associated with the request arguments. This creates a window where the memory locations previously accessed by the copy chain logic remain invalid but are still being referenced, resulting in undefined behavior and potential system instability.
This vulnerability directly maps to CWE-416, which describes use-after-free conditions in software development, and aligns with ATT&CK technique T1059.003 for execution through kernel modules. The impact extends beyond simple memory corruption as it can potentially enable privilege escalation or system crashes when malicious actors exploit the race condition by carefully orchestrating concurrent operations against FUSE filesystem instances.
The operational implications of this vulnerability are significant for systems utilizing FUSE filesystems, particularly those running in multi-threaded environments where asynchronous I/O operations are common. Attackers could leverage this flaw to cause system panics, data corruption, or potentially gain elevated privileges if they can control the timing and sequence of concurrent FUSE operations. The fix implemented by re-locking the request structure within fuse_ref_folio() before return ensures proper synchronization and prevents other threads from accessing freed memory resources during the critical section of execution.
The mitigation strategy addresses the core issue by enforcing proper locking semantics throughout the function's execution path, preventing race conditions between request termination and subsequent access to request arguments. This approach aligns with established kernel security practices for managing concurrent access to shared data structures and prevents the scenario where asynchronous callbacks can free memory while other code paths attempt to reference that same memory. The solution maintains backward compatibility while strengthening the synchronization guarantees necessary for safe multi-threaded operation within the FUSE subsystem.