CVE-2026-64260: Linux Kernel Race Condition Vulnerability

CVE-2026-64260 Overview

CVE-2026-64260 is a race condition in the Linux kernel fuse-uring subsystem. The vulnerability arises from inconsistent locking around the queue->stopped field. Multiple readers check the value under lock, but fuse_uring_commit_fetch() reads it without acquiring the lock, and fuse_uring_abort_end_requests() writes it without the lock as well. This inconsistency allows a struct fuse_req to be freed via fuse_request_end while another thread performs teardown work concurrently, producing a use-after-free condition on the request object.

Critical Impact
A local, low-privileged attacker interacting with a FUSE queue can trigger a use-after-free in the kernel, enabling privilege escalation or kernel memory corruption.

Affected Products

Linux kernel versions containing the fuse-uring implementation prior to the referenced stable commits
Distributions shipping vulnerable Linux kernel builds with FUSE io_uring support enabled
Systems permitting unprivileged FUSE mounts or io_uring usage against FUSE devices

Discovery Timeline

2026-07-25 - CVE-2026-64260 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64260

Vulnerability Analysis

The defect resides in the FUSE io_uring integration layer of the Linux kernel. The queue->stopped flag governs whether a FUSE ring queue continues to accept and complete requests or is being torn down. Correct synchronization requires all accessors of queue->stopped to serialize through the queue lock. The vulnerable code path leaves two accesses unsynchronized. fuse_uring_commit_fetch() inspects the flag without the lock, and fuse_uring_abort_end_requests() mutates the flag without holding the lock. A local user issuing concurrent FUSE ring operations can drive commit and abort paths into overlapping execution, producing a use-after-free on struct fuse_req after fuse_request_end releases the request.

Root Cause

The root cause is a race condition [CWE-362] caused by inconsistent lock discipline around a shared state variable. queue->stopped is a synchronization control, and reading or writing it outside the lock invalidates the assumptions of code paths that do lock correctly. This creates a time-of-check to time-of-use gap between the commit-fetch path and the abort/teardown path.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker with the ability to interact with a FUSE queue over io_uring triggers the race by issuing overlapping commit and abort operations. Winning the race yields memory corruption of a freed fuse_req structure. From there, kernel-object reuse techniques can escalate to arbitrary kernel read/write and full privilege escalation.

No verified public proof-of-concept code is available for CVE-2026-64260. See the upstream kernel commits linked under Patch Information for the precise instruction sequence corrected by the fix.

Detection Methods for CVE-2026-64260

Indicators of Compromise

Kernel oops or KASAN: use-after-free reports referencing fuse_uring_commit_fetch, fuse_uring_abort_end_requests, or fuse_request_end in call traces
Unexpected kernel crashes on hosts where unprivileged users mount or interact with FUSE filesystems via io_uring
Process crashes or panics correlated with heavy concurrent FUSE ring submissions

Detection Strategies

Enable CONFIG_KASAN on test kernels to catch use-after-free conditions in fuse_req during FUSE stress tests
Monitor dmesg and kernel audit streams for stack traces containing fuse_uring_* symbols
Alert on new or unusual io_uring submissions against /dev/fuse from non-root user IDs

Monitoring Recommendations

Collect kernel logs centrally and search for fuse_uring symbols in crash traces
Track process behavior consistent with kernel race exploitation, such as tight-loop syscalls against FUSE devices from unprivileged users
Baseline FUSE and io_uring usage per host and alert on statistical outliers

How to Mitigate CVE-2026-64260

Immediate Actions Required

Apply the upstream Linux kernel patches referenced below and reboot affected hosts
Restrict unprivileged FUSE mounts by setting user_allow_other and related fusermount policies to the minimum required
Disable io_uring on systems that do not require it via sysctl kernel.io_uring_disabled=2 where supported

Patch Information

The fix places all reads and writes of queue->stopped under the queue lock, closing the race between commit and abort paths. Apply the stable kernel updates referenced in the Linux Kernel Commit Fix, Linux Kernel Commit Update, and Linux Kernel Commit Change. Rebuild or upgrade to a distribution kernel that incorporates these commits.

Workarounds

Disable the FUSE io_uring code path by not enabling CONFIG_FUSE_IO_URING, or blocklist the fuse module where FUSE is unused
Restrict io_uring exposure using kernel.io_uring_disabled sysctl or seccomp filters that block io_uring_setup, io_uring_enter, and io_uring_register
Limit which users can access /dev/fuse through group ownership and permission tightening

bash

# Disable io_uring system-wide for non-privileged users
sysctl -w kernel.io_uring_disabled=2
echo 'kernel.io_uring_disabled=2' >> /etc/sysctl.d/99-harden-iouring.conf

# Restrict /dev/fuse to a controlled group
chown root:fuse /dev/fuse
chmod 0660 /dev/fuse