CVE-2026-64265

In the Linux kernel, the following vulnerability has been resolved:

fuse: clear intrentry in fuseresend and fuseremovepending_req

When fuseresend() moves a request from fpq->processing back to fiq->pending, it sets FRPENDING and clears FRSENT but does not remove the requests intrentry from fiq->interrupts. If the request had FRINTERRUPTED set from a prior signal, intrentry remains dangling on fiq->interrupts. When the requesting task then receives a fatal signal, fuseremovependingreq() sees FRPENDING=1, removes the request from fiq->pending and frees it via the refcount path, also without cleaning intrentry. The stale intrentry causes use-after-free when fusereadinterrupt() iterates fiq->interrupts: - listdelinit(&req->intr_entry) -> UAF write on freed slab - req->in.h.unique -> UAF read, data leaked to userspace

Remove intrentry from fiq->interrupts in fuseresend() for interrupted requests before they are placed back on fiq->pending.

Add a WARNON if the intrentry is not empty on request destruction.