CVE-2026-64265

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the FUSE (Filesystem in Userspace) module. When the fuse resend() function moves a request from fpq->processing back to fiq->pending, it fails to remove the intr entry from fiq->interrupts if the request was previously interrupted. Subsequently, if the task receives a fatal signal, fuse remove pending req() frees the request without cleaning the intr entry. This results in a stale entry that causes a use-after-free condition when fuse read interrupt() iterates through fiq->interrupts, potentially leading to a write on a freed slab via list del init(&req->intr entry) or a read of req->in.h.unique that leaks data to userspace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.