CVE-2026-64260 (GCVE-0-2026-64260)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
Title
fuse-uring: Avoid queue->stopped races and set/read that value under lock
Summary
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue->stopped races and set/read that value under lock There are several readers of queue->stopped that check the value under lock, but fuse_uring_commit_fetch() did not and actually the value was not set under the lock in fuse_uring_abort_end_requests() either. Especially in fuse_uring_commit_fetch it is important to check under a lock, because due to races 'struct fuse_req' might be freed with fuse_request_end, but another thread/cpu might already do teardown work.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4a9bfb9b6850fec0685447aed280533cf980de70 , < 39c8e925b207afceffaa5382416ed405e0223a03 (git)
Affected: 4a9bfb9b6850fec0685447aed280533cf980de70 , < 4021a3a79eee551d95fe1e1e7c1b195d34ba8c08 (git)
Affected: 4a9bfb9b6850fec0685447aed280533cf980de70 , < b70a3aca16934c196f92abb17b01c1647b9bb63c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev_uring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "39c8e925b207afceffaa5382416ed405e0223a03",
              "status": "affected",
              "version": "4a9bfb9b6850fec0685447aed280533cf980de70",
              "versionType": "git"
            },
            {
              "lessThan": "4021a3a79eee551d95fe1e1e7c1b195d34ba8c08",
              "status": "affected",
              "version": "4a9bfb9b6850fec0685447aed280533cf980de70",
              "versionType": "git"
            },
            {
              "lessThan": "b70a3aca16934c196f92abb17b01c1647b9bb63c",
              "status": "affected",
              "version": "4a9bfb9b6850fec0685447aed280533cf980de70",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev_uring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse-uring: Avoid queue-\u003estopped races and set/read that value under lock\n\nThere are several readers of queue-\u003estopped that check the value\nunder lock, but fuse_uring_commit_fetch() did not and actually\nthe value was not set under the lock in fuse_uring_abort_end_requests()\neither. Especially in fuse_uring_commit_fetch it is important\nto check under a lock, because due to races \u0027struct fuse_req\u0027\nmight be freed with fuse_request_end, but another thread/cpu\nmight already do teardown work."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached locally by submitting IORING_OP_URING_CMD/FUSE_IO_URING_CMD_COMMIT_AND_FETCH operations on an attached /dev/fuse descriptor.\nAC:L - Once FUSE-over-io-uring is enabled, the attacker controls both race participants by issuing commit SQEs while concurrently aborting or unmounting the connection.\nPR:L - An ordinary user can create a FUSE mount through FS_USERNS_MOUNT and user namespaces, submit commands through /dev/fuse, and access the user-owned fusectl abort control without init-namespace capabilities.\nUI:N - The attacker can create the mount, generate FUSE requests, submit commits, and trigger teardown without another user\u0027s participation.\nS:U - This is a standard local kernel privilege-escalation condition within the kernel\u0027s security authority, not a guest-to-host or IOMMU boundary escape.\nC:H - The race causes a fuse_req use-after-free and double-end with stale list, pointer, and refcount accesses, which can be leveraged to disclose arbitrary kernel memory.\nI:H - Teardown writes through stale list pointers, flags, error fields, and refcounts and can corrupt or double-free a reallocated fuse_req, enabling arbitrary kernel writes or control-flow hijacking.\nA:H - The use-after-free, list corruption, and double-ending of requests can cause an oops, panic, deadlock, or complete system compromise."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:13.575Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/39c8e925b207afceffaa5382416ed405e0223a03"
        },
        {
          "url": "https://git.kernel.org/stable/c/4021a3a79eee551d95fe1e1e7c1b195d34ba8c08"
        },
        {
          "url": "https://git.kernel.org/stable/c/b70a3aca16934c196f92abb17b01c1647b9bb63c"
        }
      ],
      "title": "fuse-uring: Avoid queue-\u003estopped races and set/read that value under lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64260",
    "datePublished": "2026-07-25T08:49:11.395Z",
    "dateReserved": "2026-07-19T15:36:31.774Z",
    "dateUpdated": "2026-08-17T04:52:13.575Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64260",
      "date": "2026-09-20",
      "epss": "0.00125",
      "percentile": "0.02537"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/fuse/dev_uring.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "39c8e925b207afceffaa5382416ed405e0223a03",
                    "status": "affected",
                    "version": "4a9bfb9b6850fec0685447aed280533cf980de70",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4021a3a79eee551d95fe1e1e7c1b195d34ba8c08",
                    "status": "affected",
                    "version": "4a9bfb9b6850fec0685447aed280533cf980de70",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b70a3aca16934c196f92abb17b01c1647b9bb63c",
                    "status": "affected",
                    "version": "4a9bfb9b6850fec0685447aed280533cf980de70",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/fuse/dev_uring.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A14068C8-C11C-44AA-9581-F8861BC66FF8",
                    "versionEndExcluding": "6.18.39",
                    "versionStartIncluding": "6.14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
                    "versionEndExcluding": "7.1.4",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse-uring: Avoid queue-\u003estopped races and set/read that value under lock\n\nThere are several readers of queue-\u003estopped that check the value\nunder lock, but fuse_uring_commit_fetch() did not and actually\nthe value was not set under the lock in fuse_uring_abort_end_requests()\neither. Especially in fuse_uring_commit_fetch it is important\nto check under a lock, because due to races \u0027struct fuse_req\u0027\nmight be freed with fuse_request_end, but another thread/cpu\nmight already do teardown work."
          }
        ],
        "id": "CVE-2026-64260",
        "lastModified": "2026-08-17T05:17:24.707",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-25T10:17:06.137",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/39c8e925b207afceffaa5382416ed405e0223a03"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4021a3a79eee551d95fe1e1e7c1b195d34ba8c08"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b70a3aca16934c196f92abb17b01c1647b9bb63c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-362"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-08-05T14:05:53+00:00",
      "cve": "CVE-2026-64260",
      "id": "CVE-2026-64260",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fuse-uring: Avoid queue-\u003estopped races and set/read that value under lock",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64260.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-17T16:40:31Z",
      "cve": "CVE-2026-64260",
      "id": "CVE-2026-64260",
      "initial_release_date": "2026-07-25T16:47:07Z",
      "product_status:known_not_affected": "298",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64260",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64260.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.