CVE-2026-64262

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fuse-uring: end fuse_req on io-uring cancel task work

When io_uring delivers task work with tw.cancel set (PF_EXITING,

PF_KTHREAD fallback, or percpu_ref_is_dying on the ring context),

fuse_uring_send_in_task() takes the cancel branch, assigns

-ECANCELED, and falls through to fuse_uring_send(). That path only

flips the entry to FRRS_USERSPACE and completes the io_uring cmd;

it never discharges the ring entry's owning reference to the

fuse_req that fuse_uring_add_req_to_ring_ent() handed it at

dispatch time.

fuse_uring_send_in_task()

tw.cancel == true

err = -ECANCELED

fuse_uring_send(ent, cmd, err, issue_flags)

ent->state = FRRS_USERSPACE

list_move(&ent->list, &queue->ent_in_userspace)

ent->cmd = NULL

io_uring_cmd_done(-ECANCELED)

/* ent->fuse_req still set, req still hashed */

The fuse_req stays linked on fpq->processing[hash] and

fuse_request_end() is

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References