CVE-2026-64263: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64263 Overview

CVE-2026-64263 is a Linux kernel vulnerability in the fuse-uring subsystem. The flaw involves unsafe list handling when cancelled entries are moved to the ent_in_userspace list. The function ent_list_request_expired() dereferences ent->fuse_req unconditionally on the first entry, causing a kernel crash when it encounters a cancelled entry with no request attached. The fix frees cancelled entries directly in fuse_uring_cancel() and drops queue_refs at that point. Additionally, fuse_uring_abort() no longer gates fuse_uring_abort_end_requests() on queue_refs > 0 because cancelled entries may already have decremented the reference count while requests are still queued.

Critical Impact
A cancelled FUSE-uring entry can trigger a kernel-mode null or invalid pointer dereference, resulting in a denial-of-service crash on affected Linux systems.

Affected Products

Linux kernel versions containing the fuse-uring implementation prior to the fixed commits
Systems using FUSE (Filesystem in Userspace) with io_uring integration
Distributions shipping unpatched mainline or stable kernels referenced by the upstream commits

Discovery Timeline

2026-07-25 - CVE-2026-64263 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64263

Vulnerability Analysis

The defect resides in the FUSE io_uring cancellation path. fuse_uring_cancel() relocates available entries, those without an attached request, to the ent_in_userspace list. A separate expiry check, ent_list_request_expired(), inspects the first entry on that list and dereferences ent->fuse_req without verifying that a request is present. Because cancelled entries carry no request pointer, this dereference operates on invalid state and crashes the kernel.

The corrective patch frees the entry and decrements queue_refs directly inside fuse_uring_cancel(). This is safe because cancel serves as its own cancel handler. After io_uring_cmd_done() completes, no further cancels can be dispatched for that command, and teardown serializes with cancel through queue->lock. The abort path was also adjusted so that fuse_uring_abort_end_requests() executes unconditionally, since cancelled entries may have dropped queue_refs while requests remain queued.

Root Cause

The root cause is an unconditional pointer dereference on a list whose invariants changed after cancellation. Cancelled entries lacked an attached fuse_req, yet the expiry logic assumed one always existed, producing a null or dangling pointer dereference in kernel context.

Attack Vector

Triggering the crash requires local interaction with a FUSE mount using the io_uring backend. A local user with permission to operate on such a mount can induce cancellation while an expiry check races, producing a kernel oops and denial of service. No network vector is documented.

No public proof-of-concept code is available. For technical details, review the upstream fixes: Kernel Git Commit 198f45e, Kernel Git Commit 50f3e03, and Kernel Git Commit e8afc85.

Detection Methods for CVE-2026-64263

Indicators of Compromise

Kernel oops or panic messages referencing ent_list_request_expired or fuse_uring_cancel in dmesg output
Unexpected process termination or hangs on FUSE mounts using io_uring
Repeated kernel stack traces containing fuse_req dereference faults

Detection Strategies

Inventory hosts running kernels that include the fuse-uring subsystem and cross-reference against the fixed commits
Monitor kernel crash dumps and kdump collections for signatures matching FUSE io_uring cancellation paths
Audit workloads that combine user-mounted FUSE filesystems with io_uring to identify exposure surface

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on BUG: or Oops: entries containing FUSE symbols
Track kernel version drift across the fleet and flag unpatched hosts running FUSE-uring workloads
Correlate unexpected reboots with prior FUSE activity to identify potential triggers

How to Mitigate CVE-2026-64263

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits 198f45e, 50f3e03, and e8afc85
Update to distribution-provided kernel packages that include these fixes and reboot affected hosts
Restrict local user access on multi-tenant systems that expose FUSE mounts backed by io_uring

Patch Information

The fix is available in the mainline and stable trees through the following commits: Kernel Git Commit 198f45e, Kernel Git Commit 50f3e03, and Kernel Git Commit e8afc85. Consult your distribution's security advisories for backported package versions.

Workarounds

Disable or avoid FUSE mounts that use the io_uring backend until patched kernels are deployed
Limit the ability of unprivileged users to create FUSE mounts by restricting user_allow_other and related mount options
Reduce exposure by isolating workloads that require FUSE io_uring into dedicated, patched hosts

bash

# Check current kernel version and FUSE module status
uname -r
lsmod | grep fuse

# Restrict unprivileged FUSE mounts (example sysctl-style approach)
# Review /etc/fuse.conf and comment out 'user_allow_other' if present
sudo sed -i 's/^user_allow_other/#user_allow_other/' /etc/fuse.conf

# Apply distribution kernel updates and reboot
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-)
sudo reboot