CVE-2026-64262 Overview
CVE-2026-64262 is a Linux kernel vulnerability in the fuse-uring subsystem. The flaw arises when io_uring delivers task work with tw.cancel set, such as during PF_EXITING, PF_KTHREAD fallback, or when percpu_ref_is_dying is true on the ring context. In the cancel branch, fuse_uring_send_in_task() assigns -ECANCELED but fails to discharge the ring entry's owning reference to the fuse_req. The originating syscall thread then blocks in D-state in request_wait_answer() until fuse_abort_conn() runs. The issue was resolved in upstream Linux kernel commits.
Critical Impact
The bug leaves FUSE requests hashed on fpq->processing[hash] indefinitely, freezing syscall threads in uninterruptible sleep and, for FR_BACKGROUND requests, exhausting max_background so all subsequent background operations stall.
Affected Products
- Linux kernel versions containing the fuse-uring implementation prior to the fix commits
- Systems using FUSE filesystems with io_uring integration
- Kernel builds prior to the patches referenced in 4f45f276, bb476ef8, and bea4fe98
Discovery Timeline
- 2026-07-25 - CVE-2026-64262 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64262
Vulnerability Analysis
The vulnerability resides in the FUSE (Filesystem in Userspace) io_uring integration path. When io_uring invokes task work with the cancel flag set, fuse_uring_send_in_task() enters the cancel branch, sets the error to -ECANCELED, and falls through to fuse_uring_send(). That path transitions the entry to FRRS_USERSPACE, moves it onto queue->ent_in_userspace, clears ent->cmd, and calls io_uring_cmd_done(). It never releases the ring entry's owning reference to the associated fuse_req that fuse_uring_add_req_to_ring_ent() handed it at dispatch time.
Because the fuse_req remains linked on fpq->processing[hash] and fuse_request_end() is never invoked, the originating syscall thread blocks in uninterruptible D-state inside request_wait_answer(). The block persists until fuse_abort_conn() runs, which can span the entire connection lifetime.
Root Cause
The root cause is a missing cleanup path in the cancel branch. tw.cancel does not imply a connection abort; a single io_uring worker thread can exit while the FUSE connection stays up. The code incorrectly relied on fuse_abort_conn() to reclaim the leaked reference. For FR_BACKGROUND requests, fc->num_background is never decremented, so repeated cancels inflate the counter until max_background is reached.
Attack Vector
The condition is triggered by local activity that causes io_uring task work to be cancelled while FUSE requests are in flight. Exit of an io_uring worker thread, kthread fallback conditions, or a dying percpu reference on the ring context can each drive the code path. Repeated triggers deplete the background request quota and can render FUSE mounts unresponsive.
See the upstream fix commits for the technical details of the code path: Linux Kernel Commit 4f45f276, Linux Kernel Commit bb476ef8, and Linux Kernel Commit bea4fe98.
Detection Methods for CVE-2026-64262
Indicators of Compromise
- Processes stuck in uninterruptible sleep (D-state) with stack traces terminating in request_wait_answer()
- FUSE mounts exhibiting stalled or hung background operations after io_uring worker exits
- fc->num_background counter observed at or near max_background without corresponding active workload
Detection Strategies
- Audit running kernel versions across Linux fleets and compare against the upstream fix commits for fuse-uring
- Monitor system logs and /proc/<pid>/stack for tasks blocked in request_wait_answer() on hosts using FUSE with io_uring
- Correlate FUSE background stalls with io_uring worker exit events to identify systems exposed to the cancel-path leak
Monitoring Recommendations
- Track processes in D-state on FUSE-enabled systems and alert on prolonged blocking against FUSE queues
- Collect kernel version telemetry to identify hosts running vulnerable fuse-uring code paths
- Monitor FUSE background quota exhaustion using kernel counters where accessible
How to Mitigate CVE-2026-64262
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced by commits 4f45f276, bb476ef8, and bea4fe98 as soon as vendor builds are available
- Identify hosts running FUSE filesystems with io_uring support and prioritize them for kernel updates
- Restart affected FUSE-consuming applications after patching to clear any stuck references
Patch Information
The fix modifies the cancel branch to release the ring entry directly. The corrected path removes the entry from the queue, completes the io_uring cmd, ends the fuse_req, frees the entry, and drops its queue_refs, waking the teardown waiter if it was the last reference. Refer to Linux Kernel Commit 4f45f276, Linux Kernel Commit bb476ef8, and Linux Kernel Commit bea4fe98 for the authoritative patch source.
Workarounds
- Where feasible, disable io_uring integration for FUSE workloads until the kernel patch is deployed
- Avoid workloads that trigger frequent io_uring worker exits on hosts with active FUSE mounts
- If a mount becomes stalled, trigger a controlled FUSE connection abort to unblock queued syscall threads
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
