CVE-2026-64266

fuse: re-lock request before returning from fuse_ref_folio()

State: Published
Severity: 7.8 High
Published: Jul 25, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

fuse: re-lock request before returning from fuse_ref_folio()

fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async end callback (eg fuse_writepage_free()) can free the args while the subsequent copy chain logic after fuse_ref_folio() accesses them, leading to use-after-free issues.

Fix this by locking the request in fuse_ref_folio() before returning.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	c3021629a0d820247ee12b6c5192a1d5380e21c6 to before 1f9156714592356b4fda57beac7eab9c2a462dd3Affected c3021629a0d820247ee12b6c5192a1d5380e21c6 to before 5630da218a45ba80f0aba0846cbe8aa655da122bAffected c3021629a0d820247ee12b6c5192a1d5380e21c6 to before 1ca605cfa59377f0143fb35b5b01360f37d1b7c4Affected c3021629a0d820247ee12b6c5192a1d5380e21c6 to before 0e4a5a000123d81234e27a2f8187688cf608f755Affected c3021629a0d820247ee12b6c5192a1d5380e21c6 to before e6aa539720c3d8def69683ed0c07cf9faea4e8beAffected c3021629a0d820247ee12b6c5192a1d5380e21c6 to before be353caffa8640f5e25fb3714ce8b0cef5e410e5Affected c3021629a0d820247ee12b6c5192a1d5380e21c6 to before 65a1c2551f7e16085acbb54aedde1feaa559ba7aAffected c3021629a0d820247ee12b6c5192a1d5380e21c6 to before b5befa80fdbe287a98480effed9564712924add5Affected
LinuxLinux	2.6.35Affected before 2.6.35Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

c3021629a0d820247ee12b6c5192a1d5380e21c6 to before 1f9156714592356b4fda57beac7eab9c2a462dd3Affected
c3021629a0d820247ee12b6c5192a1d5380e21c6 to before 5630da218a45ba80f0aba0846cbe8aa655da122bAffected
c3021629a0d820247ee12b6c5192a1d5380e21c6 to before 1ca605cfa59377f0143fb35b5b01360f37d1b7c4Affected
c3021629a0d820247ee12b6c5192a1d5380e21c6 to before 0e4a5a000123d81234e27a2f8187688cf608f755Affected
c3021629a0d820247ee12b6c5192a1d5380e21c6 to before e6aa539720c3d8def69683ed0c07cf9faea4e8beAffected
c3021629a0d820247ee12b6c5192a1d5380e21c6 to before be353caffa8640f5e25fb3714ce8b0cef5e410e5Affected
c3021629a0d820247ee12b6c5192a1d5380e21c6 to before 65a1c2551f7e16085acbb54aedde1feaa559ba7aAffected
c3021629a0d820247ee12b6c5192a1d5380e21c6 to before b5befa80fdbe287a98480effed9564712924add5Affected

LinuxLinux

2.6.35Affected
before 2.6.35Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.