CVE-2026-64261

HighCVSS 7.8/10Last modified Aug 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues

fuse_uring_async_stop_queues() might run when the last reference on ring->queue_refs was already dropped.

In order to avoid an early destruction a reference on struct fuse_conn is now taken before starting fuse_uring_async_stop_queues() and that reference is only released when that delayed work queue terminates.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= 4a9bfb9b6850fec0685447aed280533cf980de70, < 23a356e0bd96c8d5fb3ddff069f692bf10cab5c1; >= 4a9bfb9b6850fec0685447aed280533cf980de70, < 95d7f50aff2a5f71557263ff25b97b2951f32bf8; >= 4a9bfb9b6850fec0685447aed280533cf980de70, < d351da75066955144515cb2f9aa959f24a04287a
LinuxLinux6.14

References

Timeline

Published
Jul 25, 2026
Last modified
Aug 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-642625.5In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fuse_req on io-uring cancel task work When io_uring deCVE-2026-642635.5In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to ent_in_userspace list fuse_uCVE-2026-642645.5In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuse_uring_commit copy_from_user() rCVE-2026-642657.8In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req WhenCVE-2026-642667.8In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_ref_folio() fuse_ref_CVE-2026-642675.5In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSE_NOTIFY_PRUNE valCVE-2026-642689.8In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In driversCVE-2026-642699.1In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg CVE-2026-64276.4The a3 Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.7.6 This is due tCVE-2026-642707.8In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - reject an oversized device packet size mms114_interrupCVE-2026-642717.8In the Linux kernel, the following vulnerability has been resolved: Input: touchwin - reset the packet index on every complete packet tw_iCVE-2026-642727.8In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch indexing for MMS134S and MMS136 The MMS134S
CVE-2026-64261: High severity, CVSS 7.8 | Vulnix