Executive brief
A vulnerability was identified in the Linux kernel's FUSE (Filesystem in Userspace) subsystem when using the io_uring interface. A malicious local user could potentially trigger a system crash or memory corruption by sending specially crafted requests that exploit a timing issue during data copying. This could lead to a denial of service or unauthorized access to system memory.
Technical details
A race condition exists in fs/fuse/dev_uring.c within the Linux kernel's FUSE-over-io_uring implementation. The vulnerability is a use-after-free (UAF) caused by fuse_uring_add_to_pq() being called before memcpy operations in fuse_uring_send_in_task() are complete. A malicious userspace process can send a commit SQE for a request ID that has not yet been fully processed by the kernel, leading to fuse_uring_commit_fetch() ending the request prematurely while the kernel is still performing memory copies. The fix reorders the operations so the request is only added to the processing queue after all preparation and copy work is finished.
Affected products
- Linux Linux Kernel 6.14 through 6.18.38, 7.1.3
Timeline
- 2026-06-08: disclosed: Initial patch authored by Bernd Schubert
- 2026-07-18: patched: Patches committed to stable branches by Greg Kroah-Hartman
- 2026-07-25: advisory: CVE-2026-64259 published