Answer in brief
CVE-2026-64265 records a Unknown severity vulnerability in fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=760eac73f9f69aa28fcb3050b4946c2dcc656d12 <1d8ecd0cd696a5df0b2f72046a4ccee5d2a8ec2c || >=760eac73f9f69aa28fcb3050b4946c2dcc656d12 <7366e6f4d2b4c7002b13fb01219e83679dad4127 || >=760eac73f9f69aa28fcb3050b4946c2dcc656d12 <893479015cb6442fd389d3b553ab3036c9541715 || >=760eac73f9f69aa28fcb3050b4946c2dcc656d12 <f8fce75fedf73ac72aa09163deb8f4291fdcaad2 | 1d8ecd0cd696a5df0b2f72046a4ccee5d2a8ec2c, 7366e6f4d2b4c7002b13fb01219e83679dad4127, 893479015cb6442fd389d3b553ab3036c9541715, f8fce75fedf73ac72aa09163deb8f4291fdcaad2 |
| Linux/Linuxgeneric | 6.9 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req When fuse_resend() moves a request from fpq->processing back to fiq->pending, it sets FR_PENDING and clears FR_SENT but does not remove the requests intr_entry from fiq->interrupts. If the request had FR_INTERRUPTED set from a prior signal, intr_entry remains dangling on fiq->interrupts. When the requesting task then receives a fatal signal, fuse_remove_pending_req() sees FR_PENDING=1, removes the request from fiq->pending and frees it via the refcount path, also without cleaning intr_entry. The stale intr_entry causes use-after-free when fuse_read_interrupt() iterates fiq->interrupts: - list_del_init(&req->intr_entry) -> UAF write on freed slab - req->in.h.unique -> UAF read, data leaked to userspace Remove intr_entry from fiq->interrupts in fuse_resend() for interrupted requests before they are placed back on fiq->pending. Add a WARN_ON if the intr_entry is not empty on request destruction.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-64265 records a Unknown severity vulnerability in fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=760eac73f9f69aa28fcb3050b4946c2dcc656d12 <1d8ecd0cd696a5df0b2f72046a4ccee5d2a8ec2c || >=760eac73f9f69aa28fcb3050b4946c2dcc656d12 <7366e6f4d2b4c7002b13fb01219e83679dad4127 || >=760eac73f9f69aa28fcb3050b4946c2dcc656d12 <893479015cb6442fd389d3b553ab3036c9541715 || >=760eac73f9f69aa28fcb3050b4946c2dcc656d12 <f8fce75fedf73ac72aa09163deb8f4291fdcaad2 | 1d8ecd0cd696a5df0b2f72046a4ccee5d2a8ec2c, 7366e6f4d2b4c7002b13fb01219e83679dad4127, 893479015cb6442fd389d3b553ab3036c9541715, f8fce75fedf73ac72aa09163deb8f4291fdcaad2 |
| Linux/Linuxgeneric | 6.9 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req When fuse_resend() moves a request from fpq->processing back to fiq->pending, it sets FR_PENDING and clears FR_SENT but does not remove the requests intr_entry from fiq->interrupts. If the request had FR_INTERRUPTED set from a prior signal, intr_entry remains dangling on fiq->interrupts. When the requesting task then receives a fatal signal, fuse_remove_pending_req() sees FR_PENDING=1, removes the request from fiq->pending and frees it via the refcount path, also without cleaning intr_entry. The stale intr_entry causes use-after-free when fuse_read_interrupt() iterates fiq->interrupts: - list_del_init(&req->intr_entry) -> UAF write on freed slab - req->in.h.unique -> UAF read, data leaked to userspace Remove intr_entry from fiq->interrupts in fuse_resend() for interrupted requests before they are placed back on fiq->pending. Add a WARN_ON if the intr_entry is not empty on request destruction.
Quoted source text, attributed separately from HOL analysis.