CVE-2026-64258 Overview
CVE-2026-64258 is a NULL pointer dereference vulnerability in the Linux kernel's fuse-uring subsystem. The flaw resides in the handling of ring buffer copy failures within the Filesystem in Userspace (FUSE) io_uring integration. When a copy into the userspace ring buffer fails, the request is terminated and fuse_uring_req_end() sets ent->fuse_req to NULL. However, the entry remains on ent_w_req_queue in the FRRS_FUSE_REQ state. The request expiration logic can then scan ent_w_req_queue during the window before the entry is moved off, dereferencing the NULL pointer and triggering a kernel crash [CWE-476].
Critical Impact
Local attackers on systems using FUSE with io_uring can trigger a kernel NULL pointer dereference, resulting in denial of service.
Affected Products
- Linux kernel with fuse-uring support enabled
- FUSE filesystems using io_uring interface
- Distributions shipping affected upstream kernel commits
Discovery Timeline
- 2026-07-25 - CVE-2026-64258 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64258
Vulnerability Analysis
The fuse-uring subsystem provides an io_uring-based transport for FUSE requests, enabling high-performance communication between kernel FUSE clients and userspace filesystem daemons. Requests in flight are tracked on the ent_w_req_queue queue with associated state machine values.
When the kernel copies request data into the userspace ring buffer and that copy operation fails, the code path terminates the request through fuse_uring_req_end(). This function clears the ent->fuse_req pointer by setting it to NULL but does not simultaneously remove the entry from ent_w_req_queue or transition its state away from FRRS_FUSE_REQ.
A concurrent request expiration handler iterates ent_w_req_queue looking for entries in FRRS_FUSE_REQ state to process. Encountering the terminated entry, the handler dereferences ent->fuse_req, which is now NULL, causing a kernel oops.
Root Cause
The root cause is an inconsistent state transition in the error path. The code nullifies the request pointer without atomically dequeuing the entry or updating its state to reflect that the request is no longer valid. This creates a window where iterators observe an entry advertised as holding a valid request while the underlying pointer is NULL.
Attack Vector
A local unprivileged user with the ability to interact with a FUSE mount using the io_uring interface can trigger conditions that cause ring buffer copy failures. Racing the failure path against the expiration scanner produces the NULL dereference. Successful exploitation results in a kernel crash and denial of service. See the upstream fix in Kernel Git Commit 0a7f330 for technical details.
Detection Methods for CVE-2026-64258
Indicators of Compromise
- Kernel oops or panic messages referencing fuse_uring_req_end or ent_w_req_queue in dmesg output
- Unexpected FUSE daemon terminations correlated with kernel stack traces citing NULL pointer dereferences
- System crash dumps showing faulting address 0x0 within FUSE io_uring call paths
Detection Strategies
- Monitor /var/log/kern.log and journalctl -k for kernel oops entries mentioning fuse or uring symbols
- Correlate FUSE mount usage with kernel crash telemetry to identify hosts exercising the vulnerable code path
- Audit running kernel versions across the fleet against upstream stable commits 0a7f330, 0b466cf, and 1c57a69
Monitoring Recommendations
- Track FUSE filesystem processes for abnormal restarts or crashes
- Alert on kernel panic events on systems where userspace filesystems are business-critical
- Inventory hosts running kernels that predate the fix commits
How to Mitigate CVE-2026-64258
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 0a7f330, 0b466cf, and 1c57a69 from the Linux stable tree
- Update to a distribution kernel release that incorporates the fuse-uring fix
- Restrict FUSE mount privileges on multi-tenant systems where feasible
Patch Information
The fix removes the entry from ent_w_req_queue and transitions its state from FRRS_FUSE_REQ to FRRS_INVALID before terminating the request. This eliminates the window in which the expiration scanner can encounter a NULL ent->fuse_req. See Kernel Git Commit 0b466cf and Kernel Git Commit 1c57a69 for the backported changes.
Workarounds
- Disable io_uring-based FUSE transports and fall back to the legacy /dev/fuse character device interface where operationally acceptable
- Limit FUSE mount capability to trusted users by configuring user_allow_other and mount ownership restrictively
- Deploy kernel lockdown or seccomp policies that restrict io_uring usage for untrusted processes
# Configuration example: restrict io_uring via sysctl (kernel 6.6+)
sysctl -w kernel.io_uring_disabled=2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
