GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-64261 (GCVE-0-2026-64261)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
Title
fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues
Summary
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues fuse_uring_async_stop_queues() might run when the last reference on ring->queue_refs was already dropped. In order to avoid an early destruction a reference on struct fuse_conn is now taken before starting fuse_uring_async_stop_queues() and that reference is only released when that delayed work queue terminates.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4a9bfb9b6850fec0685447aed280533cf980de70 , < 23a356e0bd96c8d5fb3ddff069f692bf10cab5c1 (git)
Affected: 4a9bfb9b6850fec0685447aed280533cf980de70 , < 95d7f50aff2a5f71557263ff25b97b2951f32bf8 (git)
Affected: 4a9bfb9b6850fec0685447aed280533cf980de70 , < d351da75066955144515cb2f9aa959f24a04287a (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev_uring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "23a356e0bd96c8d5fb3ddff069f692bf10cab5c1",
              "status": "affected",
              "version": "4a9bfb9b6850fec0685447aed280533cf980de70",
              "versionType": "git"
            },
            {
              "lessThan": "95d7f50aff2a5f71557263ff25b97b2951f32bf8",
              "status": "affected",
              "version": "4a9bfb9b6850fec0685447aed280533cf980de70",
              "versionType": "git"
            },
            {
              "lessThan": "d351da75066955144515cb2f9aa959f24a04287a",
              "status": "affected",
              "version": "4a9bfb9b6850fec0685447aed280533cf980de70",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev_uring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues\n\nfuse_uring_async_stop_queues() might run when the last reference\non ring-\u003equeue_refs was already dropped.\n\nIn order to avoid an early destruction a reference on struct fuse_conn\nis now taken before starting fuse_uring_async_stop_queues() and that\nreference is only released when that delayed work queue terminates."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached locally through IORING_OP_URING_CMD on a FUSE or CUSE device and connection teardown; no network path invokes it.\nAC:L - The attacker controls ring-entry creation or cancellation and closing the final channel, allowing both sides of the race to be driven and retried.\nPR:L - The vulnerable io_uring handler has no capability check, and a basic user can access a delegated FUSE/CUSE device; FUSE also supports unprivileged user-namespace mounts.\nUI:N - The attacker can create the connection, issue concurrent io_uring operations, and initiate teardown without any separate victim action.\nS:U - Exploitation compromises the same host kernel security authority; this is standard local kernel privilege escalation rather than a VM or IOMMU boundary escape.\nC:H - The stale delayed worker accesses reclaimed kmalloc-192 ring, queue, and list objects, allowing heap replacement to turn the UAF into kernel-memory disclosure primitives.\nI:H - The worker performs list and synchronization operations through freed, reclaimable pointers, making arbitrary writes or control-flow hijacking and kernel code execution defensible.\nA:H - The bug has produced a KASAN slab-use-after-free in asynchronous queue teardown and can cause a kernel oops, panic, or unrecoverable list corruption."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:14.647Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/23a356e0bd96c8d5fb3ddff069f692bf10cab5c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/95d7f50aff2a5f71557263ff25b97b2951f32bf8"
        },
        {
          "url": "https://git.kernel.org/stable/c/d351da75066955144515cb2f9aa959f24a04287a"
        }
      ],
      "title": "fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64261",
    "datePublished": "2026-07-25T08:49:11.999Z",
    "dateReserved": "2026-07-19T15:36:31.774Z",
    "dateUpdated": "2026-08-17T04:52:14.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64261",
      "date": "2026-09-16",
      "epss": "0.00157",
      "percentile": "0.05267"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64261\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:06.243\",\"lastModified\":\"2026-08-17T05:17:24.837\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues\\n\\nfuse_uring_async_stop_queues() might run when the last reference\\non ring-\u003equeue_refs was already dropped.\\n\\nIn order to avoid an early destruction a reference on struct fuse_conn\\nis now taken before starting fuse_uring_async_stop_queues() and that\\nreference is only released when that delayed work queue terminates.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/fuse/dev_uring.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4a9bfb9b6850fec0685447aed280533cf980de70\",\"lessThan\":\"23a356e0bd96c8d5fb3ddff069f692bf10cab5c1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a9bfb9b6850fec0685447aed280533cf980de70\",\"lessThan\":\"95d7f50aff2a5f71557263ff25b97b2951f32bf8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4a9bfb9b6850fec0685447aed280533cf980de70\",\"lessThan\":\"d351da75066955144515cb2f9aa959f24a04287a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/fuse/dev_uring.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.18.39\",\"matchCriteriaId\":\"A14068C8-C11C-44AA-9581-F8861BC66FF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.1.4\",\"matchCriteriaId\":\"6228DDD6-4557-4AA3-9F43-AB995D471E42\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/23a356e0bd96c8d5fb3ddff069f692bf10cab5c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/95d7f50aff2a5f71557263ff25b97b2951f32bf8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d351da75066955144515cb2f9aa959f24a04287a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-27T06:08:53+00:00",
      "cve": "CVE-2026-64261",
      "id": "CVE-2026-64261",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "275",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64261.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-17T16:40:30Z",
      "cve": "CVE-2026-64261",
      "id": "CVE-2026-64261",
      "initial_release_date": "2026-07-25T16:47:06Z",
      "product_status:known_not_affected": "298",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64261",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64261.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.