CVE-2026-64265

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req

When fuse_resend() moves a request from fpq->processing back to

fiq->pending, it sets FR_PENDING and clears FR_SENT but does not

remove the requests intr_entry from fiq->interrupts. If the

request had FR_INTERRUPTED set from a prior signal, intr_entry

remains dangling on fiq->interrupts. When the requesting task

then receives a fatal signal, fuse_remove_pending_req() sees

FR_PENDING=1, removes the request from fiq->pending and frees it

via the refcount path, also without cleaning intr_entry. The

stale intr_entry causes use-after-free when fuse_read_interrupt()

iterates fiq->interrupts:

- list_del_init(&req->intr_entry) -> UAF write on freed slab

- req->in.h.unique -> UAF read, data leaked to userspace

Remove intr_entry from fiq->interrupts in fuse_resend() for

interrupted requests before they are placed back on fiq->pending.

Add a WARN_ON if t

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References