fuse-uring: make a fuse_req on SQE commit only findable after memcpy (CVE-2026-64259) | HOL Guard CVE

High · CVSS 7.8CVE-2026-64259

fuse-uring: make a fuse_req on SQE commit only findable after memcpy

Answer in brief

CVE-2026-64259 records a High severity (CVSS 7.8) vulnerability in fuse-uring: make a fuse_req on SQE commit only findable after memcpy. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Jul 25, 2026Updated Aug 17, 2026Source checked Sep 20, 2026First seen by HOL Aug 5, 2026Material review Aug 17, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.8
Exploitation: Not marked as known exploited
Affected software: 3 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Affected products and reported versions
Product	Affected versions	Fixed versions
cpe:2.3:o:linux:linux_kernel::::::::	Not reported	Not reported

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=c090c8abae4b6b77a1bee116aa6c385456ebef96 <e1711479e9068ea31b31353a702a51e639c3d059 \|\| >=c090c8abae4b6b77a1bee116aa6c385456ebef96 <a635f427d57e2012102ae4886b48d8955c59fb86 \|\| >=c090c8abae4b6b77a1bee116aa6c385456ebef96 <1efd3d474fc0ba74dfd984249bca78807d739812	e1711479e9068ea31b31353a702a51e639c3d059, a635f427d57e2012102ae4886b48d8955c59fb86, 1efd3d474fc0ba74dfd984249bca78807d739812
Linux/Linuxgeneric	6.14	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to e1711479e9068ea31b31353a702a51e639c3d059 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Aug 5, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse_req on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server (io_uring_cmd_done() not called) yet. fuse_uring_commit_fetch() ends the fuse request when the ring entry has a wrong state, but that could have caused a use-after-free with the memcpy operations in fuse_uring_send_in_task(). In order to avoid such races the call of fuse_uring_add_to_pq() is moved after the copy operations and just before completing the io-uring request - malicious userspace cannot find the request anymore until all prepration work in fuse-client/kernel is completed. This also moves fuse_uring_add_to_pq() a bit up in the code to avoid a forward declaration. Also not with a preparation commit, to make it easier to back port to older kernels.

Quoted source text, attributed separately from HOL analysis.