CVE-2026-64261 Overview
CVE-2026-64261 is a use-after-free vulnerability in the Linux kernel's fuse-uring subsystem. The flaw resides in fuse_uring_async_stop_queues(), which could execute after the final reference on ring->queue_refs was already released. When the delayed work item ran against freed state, the kernel accessed memory that no longer belonged to the ring structure. Maintainers resolved the issue by taking a reference on struct fuse_conn before starting fuse_uring_async_stop_queues() and releasing it only when the delayed work queue terminates.
Critical Impact
A local attacker with the ability to interact with FUSE-over-io_uring queues can trigger memory corruption in kernel space, leading to privilege escalation or denial of service.
Affected Products
- Linux kernel builds shipping the fuse-uring code path prior to the fixed commits
- Distributions consuming the affected stable kernel branches
- Systems exposing FUSE with io_uring support to unprivileged users
Discovery Timeline
- 2026-07-25 - CVE-2026-64261 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64261
Vulnerability Analysis
The defect sits in the FUSE (Filesystem in Userspace) io_uring integration layer of the Linux kernel. FUSE-uring uses per-queue reference counting through ring->queue_refs to coordinate teardown of asynchronous work. The function fuse_uring_async_stop_queues() is scheduled as delayed work to stop outstanding queues during connection shutdown.
The function could run after the last reference on ring->queue_refs had already been dropped by another concurrent code path. At that point, the surrounding fuse_conn and ring structures were eligible for destruction, but the delayed work item still held pointers into them. When the work callback dereferenced those pointers, it operated on freed memory, producing a classic use-after-free condition [CWE-416].
The patch adds an explicit reference on struct fuse_conn prior to scheduling fuse_uring_async_stop_queues(). That reference is only released when the delayed work queue completes, guaranteeing that the underlying connection object outlives any pending stop work.
Root Cause
The root cause is a lifetime mismatch between ring->queue_refs and the delayed work item that stops the queues. The stop routine did not hold a reference on its parent fuse_conn, so a concurrent drop of the last queue reference could free the connection while the work item was still queued or executing.
Attack Vector
Exploitation requires local access with the ability to mount or interact with a FUSE filesystem that uses io_uring. An attacker races connection teardown against pending asynchronous stop work to trigger the freed access. Successful exploitation can corrupt kernel memory and allow escalation from a low-privileged account to kernel context. Remote exploitation is not possible without prior local access.
No code examples are published beyond the upstream fix. See the kernel.org commit for the exact reference-count changes.
Detection Methods for CVE-2026-64261
Indicators of Compromise
- Kernel oops or general protection fault messages referencing fuse_uring_async_stop_queues in dmesg
- KASAN reports flagging use-after-free reads or writes inside fs/fuse/dev_uring.c
- Unexpected crashes during FUSE unmount or connection teardown on hosts using io_uring
Detection Strategies
- Enable CONFIG_KASAN on test kernels to surface the freed access during fuzzing or QA
- Audit installed kernel packages against the fixed commits 23a356e0bd96, 95d7f50aff2a, and d351da750669
- Correlate FUSE mount activity from non-root users with kernel crash telemetry
Monitoring Recommendations
- Forward /var/log/kern.log and journalctl -k output to a central logging platform for kernel fault analysis
- Alert on repeated FUSE-related kernel panics originating from the same user session
- Track processes invoking mount.fuse or io_uring IORING_OP_URING_CMD against FUSE devices
How to Mitigate CVE-2026-64261
Immediate Actions Required
- Apply the stable kernel updates containing commits 23a356e0bd96c8d5fb3ddff069f692bf10cab5c1, 95d7f50aff2a5f71557263ff25b97b2951f32bf8, and d351da75066955144515cb2f9aa959f24a04287a
- Reboot affected hosts after installing the patched kernel to ensure the vulnerable code is unloaded
- Inventory systems that permit unprivileged FUSE mounts and prioritize those for patching
Patch Information
The fix is available in the upstream Linux kernel stable tree. Consult the kernel.org commit, the second commit reference, and the third commit reference for backport details. Distribution vendors are shipping the fix through their standard kernel security update channels.
Workarounds
- Disable FUSE-over-io_uring where not required by blocking CONFIG_FUSE_IO_URING in custom kernel builds
- Restrict unprivileged user namespaces and FUSE mounts via sysctl kernel.unprivileged_userns_clone=0 on distributions that support it
- Limit access to /dev/fuse through filesystem permissions or AppArmor/SELinux policy until patches are deployed
# Configuration example
# Verify running kernel does not expose the vulnerable path
uname -r
grep CONFIG_FUSE_IO_URING /boot/config-$(uname -r)
# Optional: restrict unprivileged FUSE mounts
sysctl -w kernel.unprivileged_userns_clone=0
chmod 0600 /dev/fuse
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
