CVE-2026-64588

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

fuse-uring: fix data races on ring->ready

On weakly-ordered architectures, the store to fiq->ops can be

reordered past the store to ring->ready, allowing a CPU that sees

ring->ready == true via fuse_uring_ready() to dispatch requests

through a stale fiq->ops pointer. Upgrade the store to

smp_store_release() and the load in fuse_uring_ready() to

smp_load_acquire() so that the preceding WRITE_ONCE(fiq->ops, ...)

is visible to any CPU that observes ring->ready == true.

Additionally, fuse_uring_do_register() publishes ring->ready with

WRITE_ONCE() but the fast-path check reads it with a plain load.

This is a marked-vs-unmarked access that KCSAN will flag. Wrap it in

READ_ONCE() to mark it without adding unnecessary ordering.

Also wrap the fc->ring load in fuse_uring_ready() in READ_ONCE() to

prevent the compiler from reloading it between the NULL check and the

dereference.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References