Description
In the Linux kernel, the following vulnerability has been resolved:

fuse-uring: make a fuse_req on SQE commit only findable after memcpy

Bad userspace might try to trick us and send commit SQEs request
unique / commit-id of requests that are not even send to
fuse-server (io_uring_cmd_done() not called) yet.

fuse_uring_commit_fetch() ends the fuse request when the ring entry
has a wrong state, but that could have caused a use-after-free
with the memcpy operations in fuse_uring_send_in_task().
In order to avoid such races the call of fuse_uring_add_to_pq()
is moved after the copy operations and just before completing
the io-uring request - malicious userspace cannot find the request
anymore until all prepration work in fuse-client/kernel is completed.

This also moves fuse_uring_add_to_pq() a bit up in the code to
avoid a forward declaration. Also not with a preparation commit,
to make it easier to back port to older kernels.
Published: 2026-07-25
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw resides in the fuse‑uring commit path of the Linux kernel. A malicious user‑space program can submit specially crafted IO‑uring submit queue entries that reference a fuse request that has not yet been committed to the fuse server. Because the kernel copies the request data before adding the request to the processing queue, a use‑after‑free can occur if the request is released before the copy finishes, resulting in kernel memory corruption and unpredictable behaviour.

Affected Systems

All Linux kernel builds that lack the patch introduced by commit 1efd3d474fc0ba… are affected. Any kernel released after this commit (for example, recent mainline 6.x releases) includes the mitigation, while older kernels that have not applied the change remain vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates a high‑severity local flaw, and the EPSS score is below 1 %, implying that exploitation attempts are rare at present. This vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector involves a local user‑space process able to create arbitrary IO‑uring submit queue entries to trigger the use‑after‑free, which could lead to kernel memory corruption.

Generated by OpenCVE AI on August 13, 2026 at 10:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that incorporates the fix introduced by commit 1efd3d474fc0ba… (typical recent mainline releases).
  • If the distribution kernel is not yet updated, apply the backport patch to the kernel source tree, rebuild, and install the patched kernel.
  • As a temporary measure, limit or disable IO‑uring usage for untrusted applications by configuring Linux capabilities, SELinux or AppArmor, until the kernel can be upgraded.

Generated by OpenCVE AI on August 13, 2026 at 10:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 12 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Mon, 03 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Wed, 29 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-763
References

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Mon, 27 Jul 2026 05:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Sat, 25 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse_req on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server (io_uring_cmd_done() not called) yet. fuse_uring_commit_fetch() ends the fuse request when the ring entry has a wrong state, but that could have caused a use-after-free with the memcpy operations in fuse_uring_send_in_task(). In order to avoid such races the call of fuse_uring_add_to_pq() is moved after the copy operations and just before completing the io-uring request - malicious userspace cannot find the request anymore until all prepration work in fuse-client/kernel is completed. This also moves fuse_uring_add_to_pq() a bit up in the code to avoid a forward declaration. Also not with a preparation commit, to make it easier to back port to older kernels.
Title fuse-uring: make a fuse_req on SQE commit only findable after memcpy
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-05T12:40:20.332Z

Reserved: 2026-07-19T15:36:31.773Z

Link: CVE-2026-64259

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-07-25T10:17:06.033

Modified: 2026-08-12T15:53:00.697

Link: CVE-2026-64259

cve-icon Redhat

Severity :

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64259 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T10:45:04Z

Weaknesses
  • CWE-416

    Use After Free

  • CWE-763

    Release of Invalid Pointer or Reference