CVE-2026-64259: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64259 Overview

CVE-2026-64259 is a use-after-free vulnerability in the Linux kernel's fuse-uring subsystem. The flaw exists in the commit path of Filesystem in Userspace (FUSE) over io_uring, where a fuse_req structure could be located by userspace before the kernel finished preparing it. Malicious userspace could submit a commit Submission Queue Entry (SQE) referencing a request that had not yet been sent to the fuse-server, racing the memcpy operations in fuse_uring_send_in_task(). Successful exploitation results in a use-after-free condition inside the kernel.

Critical Impact
Local attackers with the ability to submit crafted io_uring commit SQEs can trigger a kernel use-after-free, leading to memory corruption, denial of service, or local privilege escalation.

Affected Products

Linux kernel branches containing the fuse-uring implementation
Distributions shipping vulnerable stable kernels prior to the referenced fix commits
Systems where FUSE is available to unprivileged local users

Discovery Timeline

2026-07-25 - CVE-2026-64259 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64259

Vulnerability Analysis

The vulnerability resides in fuse_uring_commit_fetch(), which processes commit SQEs from userspace over the io_uring interface. A cooperating (but malicious) userspace process can submit a commit SQE that references the unique or commit-id of a request that the kernel has not yet dispatched to the fuse-server through io_uring_cmd_done().

When the ring entry is in an unexpected state, the kernel terminates the fuse request. However, the concurrent memcpy operations inside fuse_uring_send_in_task() may still be operating on the freed request memory. The result is a classic use-after-free race in a privileged kernel context, reachable from local unprivileged code on systems exposing FUSE.

Root Cause

The root cause is an ordering bug between request registration and request preparation. The kernel added the request to the per-queue lookup structure (fuse_uring_add_to_pq()) before completing the memcpy copy-in phase. This made the request findable by userspace commit operations while its data was still being written, opening a Time-of-Check to Time-of-Use (TOCTOU) window.

Attack Vector

The attack is local and requires the ability to open a fuse device and interact with its io_uring command interface. A malicious userspace program submits crafted commit SQEs targeting requests still under kernel preparation. Racing the commit path against fuse_uring_send_in_task() triggers the use-after-free on the fuse_req structure.

No verified public exploit code is available. The upstream fix moves fuse_uring_add_to_pq() after the memcpy operations and immediately before completing the io_uring request, so malicious userspace cannot locate the request until kernel-side preparation finishes. See the kernel commits 1efd3d474fc0, a635f427d57e, and e1711479e906 for the resolved patch series.

Detection Methods for CVE-2026-64259

Indicators of Compromise

Unexpected kernel oops or KASAN: use-after-free reports referencing fuse_uring_commit_fetch or fuse_uring_send_in_task in dmesg
Kernel panics or slab corruption warnings on hosts running FUSE workloads with io_uring
Unprivileged processes issuing high volumes of io_uring commit SQEs against a fuse device

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test environments to surface use-after-free access on the fuse-uring code path
Audit which local users and containers have access to /dev/fuse and can create fuse mounts
Correlate io_uring syscall telemetry (io_uring_setup, io_uring_enter) with fuse device access from non-root processes

Monitoring Recommendations

Collect and centralize kernel logs to flag stack traces containing fuse_uring_* symbols
Monitor for repeated fuse-server crashes or abnormal termination of fuse client processes
Track kernel version and patch level across the fleet to identify hosts still exposing the vulnerable code

How to Mitigate CVE-2026-64259

Immediate Actions Required

Update the Linux kernel to a stable release containing commits 1efd3d474fc0, a635f427d57e, or e1711479e906
Restrict access to /dev/fuse on multi-tenant hosts to trusted users only
Disable unprivileged user namespaces where they are not required, reducing the ability of low-privileged accounts to create fuse mounts

Patch Information

The fix reorders the fuse-uring commit path so that fuse_uring_add_to_pq() runs after the copy operations and just before completing the io_uring request. Apply the vendor kernel update that includes the referenced upstream commits. Distribution maintainers backport this fix to stable trees; consult your distribution's advisory for the exact package version.

Workarounds

Disable FUSE (fuse and fuse2/fuse3 kernel modules) on systems that do not require userspace filesystems
Prevent unprivileged users from mounting fuse filesystems by removing suid on fusermount and tightening /etc/fuse.conf
Restrict io_uring usage via sysctl kernel.io_uring_disabled=2 on kernels that support the toggle, when workloads permit

bash

# Configuration example
# Disable io_uring for unprivileged users (requires supported kernel)
echo 2 > /proc/sys/kernel/io_uring_disabled

# Remove suid from fusermount to prevent unprivileged fuse mounts
chmod u-s /usr/bin/fusermount3

# Verify running kernel includes the fuse-uring fix
uname -r