CVE-2026-64265 Overview
CVE-2026-64265 is a use-after-free vulnerability in the Linux kernel's Filesystem in Userspace (FUSE) subsystem. The flaw resides in the fuse_resend() and fuse_remove_pending_req() functions, where an interrupted request's intr_entry is not removed from fiq->interrupts before the request is placed back on fiq->pending or freed. When fuse_read_interrupt() later iterates the interrupts list, it dereferences freed slab memory. This allows a local attacker to trigger a use-after-free that leaks kernel data to userspace and corrupts kernel memory.
Critical Impact
Local attackers with the ability to interact with FUSE requests can trigger a kernel use-after-free, resulting in information disclosure and potential local privilege escalation.
Affected Products
- Linux kernel FUSE subsystem (upstream fs/fuse)
- Stable kernel branches receiving the referenced backports
- Distributions shipping affected FUSE code paths prior to the fix
Discovery Timeline
- 2026-07-25 - CVE-2026-64265 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64265
Vulnerability Analysis
The vulnerability is a use-after-free in the FUSE request lifecycle. When fuse_resend() moves a request from fpq->processing back to fiq->pending, it sets FR_PENDING and clears FR_SENT. It does not remove the request's intr_entry from fiq->interrupts. If the request had FR_INTERRUPTED set from a prior signal, the intr_entry remains dangling on the interrupts list.
When the requesting task subsequently receives a fatal signal, fuse_remove_pending_req() observes FR_PENDING=1, removes the request from fiq->pending, and frees it through the refcount path. This free path also does not clean up intr_entry. The freed request continues to be linked into fiq->interrupts.
Root Cause
The root cause is missing list cleanup on a state-transition path. Both fuse_resend() and fuse_remove_pending_req() fail to invoke removal of intr_entry from fiq->interrupts for requests that were previously marked FR_INTERRUPTED. The FUSE request lifecycle assumes interrupts are drained through the normal completion path, an assumption violated when a signal aborts the request before completion.
Attack Vector
A local unprivileged user with access to a FUSE mount can drive requests into the interrupted state and then trigger a resend or fatal signal to free the request while intr_entry remains on fiq->interrupts. When fuse_read_interrupt() walks the list, list_del_init(&req->intr_entry) performs a write to freed slab memory and req->in.h.unique reads freed memory that is then copied to userspace. The upstream fix removes intr_entry from fiq->interrupts in fuse_resend() for interrupted requests before placing them back on fiq->pending and adds a WARN_ON if intr_entry is not empty at request destruction.
No public exploit code is available. See the Linux Kernel Commit Log for the upstream patch and the additional backport commits referenced in NVD.
Detection Methods for CVE-2026-64265
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing fuse_read_interrupt, fuse_resend, or fuse_remove_pending_req in dmesg
- KASAN reports flagging use-after-free reads or writes in the FUSE subsystem on slab objects sized for struct fuse_req
- WARN_ON messages after patch deployment indicating a non-empty intr_entry at request destruction
Detection Strategies
- Enable KASAN on test kernels to surface use-after-free access during FUSE stress testing with signal delivery
- Monitor kernel logs for FUSE-related list corruption warnings and slab poisoning messages
- Audit running kernel versions across the fleet and correlate against fixed stable branches referenced in the upstream commits
Monitoring Recommendations
- Ingest dmesg and journald kernel logs into a central log platform and alert on FUSE stack traces
- Track process creation of unprivileged FUSE mount helpers and unusual signal delivery patterns against FUSE daemons
- Baseline kernel version and FUSE module hash across Linux endpoints and flag drift from patched builds
How to Mitigate CVE-2026-64265
Immediate Actions Required
- Apply the patched kernel from your distribution vendor once it ships the referenced upstream commits
- Inventory hosts that expose FUSE to unprivileged users and prioritize those for patching
- Restrict unprivileged FUSE mounts on multi-tenant and shared systems until patches are deployed
Patch Information
The fix is delivered by upstream commits 1d8ecd0cd696, 7366e6f4d2b4, 893479015cb6, and f8fce75fedf7. Refer to the Linux Kernel Commit Log and the associated stable branch backports linked from NVD. The change removes intr_entry from fiq->interrupts in fuse_resend() before requeueing interrupted requests and adds a WARN_ON guard at request destruction.
Workarounds
- Disable unprivileged user namespaces where operationally acceptable to prevent unprivileged FUSE mounts
- Set sysctl kernel.unprivileged_userns_clone=0 on distributions that expose this tunable
- Remove or restrict the fuse kernel module on systems that do not require FUSE functionality
# Configuration example
# Restrict unprivileged FUSE mounts pending patch deployment
sysctl -w kernel.unprivileged_userns_clone=0
# Optionally block loading of the fuse module on hosts that do not need it
echo 'install fuse /bin/true' > /etc/modprobe.d/disable-fuse.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
