CVE-2026-64259

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the fuse-uring component. A malicious user could send commit SQEs (Submission Queue Entries) requests with unique commit-ids for requests that have not yet been sent to the fuse-server. This occurs because fuse uring commit fetch() may end a fuse request when a ring entry is in an incorrect state, creating a race condition with memcpy operations performed in fuse uring send in task(). To resolve this, the call to fuse uring add to pq() is moved after the copy operations and immediately before the completion of the io-uring request, ensuring the request is not discoverable until all kernel and client preparations are finished.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.