CVE-2026-64260
kernel: fuse-uring: Avoid queue->stopped races and set/read that value under lock
Loading…
Severity
ModerateRed Hat Product Security
CVSS
Review impact separately from score.
Published · July 25, 2026
Updated · October 20, 2026
Description
A flaw was found in the fuse-uring component of the Linux kernel. A race condition exists where the queue->stopped flag is not consistently checked under a lock. This can allow a struct fuse_req to be prematurely freed while other operations are still in progress, potentially leading to memory corruption. A local attacker could exploit this vulnerability to cause system instability or potentially escalate privileges.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CWE-413 · Improper Resource Locking