CVE-2026-64263

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to ent_in_userspace list fuse_uring_cancel() moves entries that are available (these have no reqs attached) to the ent_in_userspace list. ent_list_request_expired() checks the first entry on ent_in_userspace and dereferences ent->fuse_req unconditionally, which will crash on a cancelled entry that was moved to this list. Fix this by freeing the entry and dropping queue_refs directly in fuse_uring_cancel(). This is safe because cancel is the cancel handler itself - after io_uring_cmd_done(), no more cancels will be dispatched for this command, and teardown serializes with cancel via queue->lock. Since cancel now decrements queue_refs, fuse_uring_abort() must no longer gate fuse_uring_abort_end_requests() on queue_refs > 0, as cancelled entries may have already dropped queue_refs while requests are still queued. Remove the gate so abort always flushes requests and stops queues.

• https://git.kernel.org/stable/c/198f45eeb9f78b2a2d6d8be95e4e43468eb2c6bcPatch
• https://git.kernel.org/stable/c/50f3e03db823cabc41fe35c27d77c2bdb112baadPatch
• https://git.kernel.org/stable/c/e8afc85acdf329361b2d8df2ad9b52364686235fPatch

Published

Jul 25, 2026

Last Modified

Aug 12, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-64258In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64259In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-6426A type mismatch vulnerability was found in QEMU's vhost infl…4.4
• CVE-2026-64260In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64261In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64262In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64264In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64265In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64266In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64267In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64268In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-64269In the Linux kernel, the following vulnerability has been re…9.1