CVE-2026-64259

kernel: fuse-uring: make a fuse_req on SQE commit only findable after memcpy

Loading…

Severity

Important

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · July 25, 2026

Updated · October 20, 2026

Description

A flaw was found in the Linux kernel's fuse-uring component. A local attacker could exploit a race condition by sending specially crafted requests before they are fully processed. This could lead to a use-after-free vulnerability, potentially allowing for arbitrary code execution or denial of service.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-763 · Release of Invalid Pointer or Reference