PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64262 Linux CVE debrief

A Linux kernel vulnerability, CVE-2026-64262, was resolved by fuse-uring: end fuse_req on io-uring cancel task work. When io_uring delivers task work with tw.cancel set, fuse_uring_send_in_task() takes the cancel branch, assigns -ECANCELED, and falls through to fuse_uring_send(). However, this path does not discharge the ring entry's owning reference to the fuse_req. As a result, the fuse_req stays linked on fpq->processing[hash] and fuse_request_end() is never invoked. This issue can cause the originating syscall thread to block in D-state in request_wait_answer() until fuse_abort_conn() runs. The fix involves ending the req and releasing the entry directly, which should prevent such deadlocks and ensure proper cleanup of fuse requests.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-25
Original CVE updated
2026-08-17
Advisory published
2026-07-25
Advisory updated
2026-08-17

Who should care

Linux kernel users and administrators should be aware of this vulnerability and ensure they are running the patched version of the kernel. This is crucial for maintaining system security and preventing potential exploits. Linux distributions and vendors should also prioritize patching and notifying their users about this vulnerability.

Technical summary

The vulnerability is related to the handling of io_uring task work in the Linux kernel. Specifically, when io_uring delivers task work with tw.cancel set, the fuse_req is not properly ended, leading to a potential deadlock. The fix involves modifying the cancel branch to release the entry directly, removing it from the queue, completing the io_uring cmd, ending the fuse_req, freeing the entry, and dropping its queue_refs. This change ensures that fuse requests are properly cleaned up, even in the event of cancellation, preventing potential system hangs or resource leaks.

Defensive priority

High

Recommended defensive actions

  • Apply the patch for fuse-uring: end fuse_req on io-uring cancel task work
  • Ensure the Linux kernel is updated to the latest version
  • Monitor system logs for potential issues related to io_uring and fuse
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved by fuse-uring: end fuse_req on io-uring cancel task work. The issue arises from the handling of io_uring task work with tw.cancel set. The fix involves releasing the entry directly and ending the fuse_req. Evidence of this vulnerability's resolution can be found in the Linux kernel patch notes and related technical documentation. However, specific details about the vulnerability's impact and affected systems are limited, and further verification is necessary to understand the full scope.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-64262 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-64262

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-64262 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64262

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4f45f276d5b4412eade6f74f2e37f3adba0473ed

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bb476ef8e1027a9d509fbaaf81f5061a07e9e5a7

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bea4fe98204b6ce7eb8e29f7bf867dd7619b3ddd

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.