Description
In the Linux kernel, the following vulnerability has been resolved:

fuse-uring: end fuse_req on io-uring cancel task work

When io_uring delivers task work with tw.cancel set (PF_EXITING,
PF_KTHREAD fallback, or percpu_ref_is_dying on the ring context),
fuse_uring_send_in_task() takes the cancel branch, assigns
-ECANCELED, and falls through to fuse_uring_send(). That path only
flips the entry to FRRS_USERSPACE and completes the io_uring cmd;
it never discharges the ring entry's owning reference to the
fuse_req that fuse_uring_add_req_to_ring_ent() handed it at
dispatch time.

fuse_uring_send_in_task()
tw.cancel == true
err = -ECANCELED
fuse_uring_send(ent, cmd, err, issue_flags)
ent->state = FRRS_USERSPACE
list_move(&ent->list, &queue->ent_in_userspace)
ent->cmd = NULL
io_uring_cmd_done(-ECANCELED)
/* ent->fuse_req still set, req still hashed */

The fuse_req stays linked on fpq->processing[hash] and
fuse_request_end() is never invoked. The originating syscall
thread blocks in D-state in request_wait_answer() until
fuse_abort_conn() runs, which can be the entire connection
lifetime. For FR_BACKGROUND requests fc->num_background is never
decremented either, so repeated cancels inflate the counter until
max_background is hit and all later background ops stall. tw.cancel does
not imply a connection abort (e.g. a single io_uring worker thread exits
while the fuse connection stays up), so this cannot be left for
fuse_abort_conn() to clean up.

Ending the req but still routing the entry through fuse_uring_send()
is not enough: that leaves a req-less entry on ent_in_userspace, and
ent_list_request_expired() dereferences ent->fuse_req unconditionally
on the head of that list, which would then NULL-deref.

Fix the cancel branch to release the entry directly. Remove it from the
queue, complete the io_uring cmd, end the fuse_req, free the entry, and
drop its queue_refs (waking the teardown waiter if it was the last).
Published: 2026-07-25
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flawed cancellation path in the kernel’s handling of FUSE requests over io_uring leaves a reference to a finished request unreleased. The request remains queued, the background counter grows without reset, and the entry’s pointer can be dereferenced as null when the kernel later cleans up, which may bring the system down. This leads to a service stall or a kernel crash, depending on the sequence of cancellations.

Affected Systems

All Linux kernel releases that have not incorporated the recent commit that corrects the fuse‑uring cancel logic are affected. The fix appears in the commits identified by the hash 4f45f276d5b4412eade6f74f2e37f3adba0473ed and related updates. Administrators should verify that their running kernel contains this change or a later release that includes it.

Risk and Exploitability

Based on the description, it is inferred that the attack vector requires a local user with access to issue io_uring operations against a FUSE mount. The EPSS score is below 1% and KEV indicates no current exploitation. The CVSS score of 5.5 reflects moderate severity. An attacker could deliberately cancel numerous io_uring tasks to exhaust the background request counter or trigger the null dereference leading to a kernel crash.

Generated by OpenCVE AI on August 13, 2026 at 11:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Replace the current kernel with a version that incorporates the fuse‑uring cancel path fix (commit hash 4f45f276d5b4412eade6f74f2e37f3adba0473ed).
  • If a kernel upgrade cannot be performed immediately, disable or restrict FUSE mounts that use io_uring until the patch is applied.
  • Monitor system logs for signs of FUSE request stalls or kernel panics and apply vendor security updates as soon as they become available.

Generated by OpenCVE AI on August 13, 2026 at 11:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 12 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-Other
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Sat, 01 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
CWE-476
CWE-667

Thu, 30 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-772
References

Sun, 26 Jul 2026 03:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
CWE-476
CWE-667

Sat, 25 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fuse_req on io-uring cancel task work When io_uring delivers task work with tw.cancel set (PF_EXITING, PF_KTHREAD fallback, or percpu_ref_is_dying on the ring context), fuse_uring_send_in_task() takes the cancel branch, assigns -ECANCELED, and falls through to fuse_uring_send(). That path only flips the entry to FRRS_USERSPACE and completes the io_uring cmd; it never discharges the ring entry's owning reference to the fuse_req that fuse_uring_add_req_to_ring_ent() handed it at dispatch time. fuse_uring_send_in_task() tw.cancel == true err = -ECANCELED fuse_uring_send(ent, cmd, err, issue_flags) ent->state = FRRS_USERSPACE list_move(&ent->list, &queue->ent_in_userspace) ent->cmd = NULL io_uring_cmd_done(-ECANCELED) /* ent->fuse_req still set, req still hashed */ The fuse_req stays linked on fpq->processing[hash] and fuse_request_end() is never invoked. The originating syscall thread blocks in D-state in request_wait_answer() until fuse_abort_conn() runs, which can be the entire connection lifetime. For FR_BACKGROUND requests fc->num_background is never decremented either, so repeated cancels inflate the counter until max_background is hit and all later background ops stall. tw.cancel does not imply a connection abort (e.g. a single io_uring worker thread exits while the fuse connection stays up), so this cannot be left for fuse_abort_conn() to clean up. Ending the req but still routing the entry through fuse_uring_send() is not enough: that leaves a req-less entry on ent_in_userspace, and ent_list_request_expired() dereferences ent->fuse_req unconditionally on the head of that list, which would then NULL-deref. Fix the cancel branch to release the entry directly. Remove it from the queue, complete the io_uring cmd, end the fuse_req, free the entry, and drop its queue_refs (waking the teardown waiter if it was the last).
Title fuse-uring: end fuse_req on io-uring cancel task work
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-25T08:49:12.599Z

Reserved: 2026-07-19T15:36:31.774Z

Link: CVE-2026-64262

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-07-25T10:17:06.350

Modified: 2026-08-12T15:52:41.887

Link: CVE-2026-64262

cve-icon Redhat

Severity :

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64262 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T11:45:03Z

Weaknesses