CVE-2026-64266

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-64266
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64266.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-64266
Downstream
Related
Published
2026-07-25T08:49:15Z
Modified
2026-08-18T03:31:23Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
fuse: re-lock request before returning from fuse_ref_folio()
Details

In the Linux kernel, the following vulnerability has been resolved:

fuse: re-lock request before returning from fuse_ref_folio()

fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async end callback (eg fuse_writepage_free()) can free the args while the subsequent copy chain logic after fuse_ref_folio() accesses them, leading to use-after-free issues.

Fix this by locking the request in fuse_ref_folio() before returning.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64266.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c3021629a0d820247ee12b6c5192a1d5380e21c6
Fixed
1f9156714592356b4fda57beac7eab9c2a462dd3
Fixed
5630da218a45ba80f0aba0846cbe8aa655da122b
Fixed
1ca605cfa59377f0143fb35b5b01360f37d1b7c4
Fixed
0e4a5a000123d81234e27a2f8187688cf608f755
Fixed
e6aa539720c3d8def69683ed0c07cf9faea4e8be
Fixed
be353caffa8640f5e25fb3714ce8b0cef5e410e5
Fixed
65a1c2551f7e16085acbb54aedde1feaa559ba7a
Fixed
b5befa80fdbe287a98480effed9564712924add5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64266.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.35
Fixed
5.10.261
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.212
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.178
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.145
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.96
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.39
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64266.json"