CVE-2026-64588: Linux Kernel Race Condition Vulnerability

CVE-2026-64588 Overview

CVE-2026-64588 is a data race vulnerability in the Linux kernel's fuse-uring subsystem. The flaw affects the synchronization of the ring->ready flag and the associated fiq->ops function pointer. On weakly-ordered architectures, the store to fiq->ops can be reordered past the store to ring->ready. A CPU that observes ring->ready == true through fuse_uring_ready() may then dispatch requests through a stale fiq->ops pointer. The issue also involves marked-versus-unmarked accesses that the Kernel Concurrency Sanitizer (KCSAN) flags.

Critical Impact
Concurrent access to ring->ready and fiq->ops without proper memory ordering can cause the kernel to dereference a stale operations pointer, leading to undefined behavior in the FUSE io_uring request dispatch path.

Affected Products

Linux kernel versions containing the fuse-uring subsystem
Weakly-ordered architectures such as ARM64 and PowerPC are most exposed to the reordering behavior
Kernel builds with FUSE io_uring support enabled

Discovery Timeline

2026-08-06 - CVE-2026-64588 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-64588

Vulnerability Analysis

The vulnerability resides in the FUSE io_uring integration layer of the Linux kernel. The fuse_uring_do_register() function publishes ring->ready using WRITE_ONCE(), while the fast path in fuse_uring_ready() reads the same field with a plain load. This marked-versus-unmarked access pattern is precisely what KCSAN identifies as a data race. In addition, the store to fiq->ops lacks release semantics, so the compiler or CPU may reorder it after the store to ring->ready.

On architectures with weak memory ordering, a second CPU can observe ring->ready == true while still seeing a stale value of fiq->ops. The dispatch path then invokes function pointers on the stale operations structure, resulting in unpredictable kernel behavior.

Root Cause

The root cause is missing acquire and release memory barriers around a publication pattern. The producer sets fiq->ops and then flips ring->ready to true, but the store ordering is not enforced. Consumers reading ring->ready gain no guarantee that the preceding write to fiq->ops is visible. The compiler is also permitted to reload fc->ring between the NULL check and the dereference in fuse_uring_ready(), introducing a secondary time-of-check to time-of-use hazard [CWE-362].

Attack Vector

The defect is a concurrency bug rather than a directly attacker-controlled input vector. Triggering it requires simultaneous FUSE io_uring registration and request submission on a weakly-ordered multiprocessor system. Local workloads that stress FUSE mount initialization while issuing io_uring operations can surface the race. The upstream fix upgrades the store to smp_store_release(), converts the load to smp_load_acquire(), and wraps the fast-path reads in READ_ONCE() to prevent compiler reloading. See the kernel.org commit for the exact patch.

Detection Methods for CVE-2026-64588

Indicators of Compromise

KCSAN reports flagging concurrent access to ring->ready in fs/fuse/dev_uring.c
Kernel oops or general protection faults originating in the FUSE io_uring request dispatch path
Unexpected NULL dereferences following FUSE mount registration on ARM64 or PowerPC systems

Detection Strategies

Enable CONFIG_KCSAN in test kernels to surface the marked-versus-unmarked access on ring->ready
Correlate FUSE mount events with kernel crash telemetry to identify races during ring initialization
Inventory kernel versions across Linux fleets and compare against the fixed commits in the stable trees

Monitoring Recommendations

Collect dmesg and kernel crash dumps from Linux endpoints running FUSE workloads and review them for fuse_uring stack traces
Monitor stable kernel advisories at kernel.org for backport availability
Track FUSE-based container and filesystem services for unexpected restarts that may indicate a triggered race

How to Mitigate CVE-2026-64588

Immediate Actions Required

Apply the stable-tree patches referenced in the kernel.org commit updates for CVE-2026-64588
Prioritize patching on weakly-ordered architectures such as ARM64 and PowerPC where reordering is observable
Rebuild and redeploy custom kernels that carry the fuse-uring subsystem

Patch Information

The fix is available in the mainline and stable Linux kernel trees. See the upstream commits 46725a00, b156bb99, and d01a09b4. The patch upgrades the fiq->ops publication to smp_store_release(), uses smp_load_acquire() in fuse_uring_ready(), and wraps the ring->ready and fc->ring reads in READ_ONCE().

Workarounds

Disable FUSE io_uring support in kernel configuration if the feature is not required
Restrict FUSE mount capabilities to trusted service accounts to reduce concurrent registration paths
Avoid deploying affected kernel builds on weakly-ordered multiprocessor hardware until patched

bash

# Verify running kernel version and check for the fuse-uring fix
uname -r
grep -R "smp_store_release" /usr/src/linux/fs/fuse/dev_uring.c