7.8

CVE-2026-64266

fuse: re-lock request before returning from fuse_ref_folio()

In the Linux kernel, the following vulnerability has been resolved:

fuse: re-lock request before returning from fuse_ref_folio()

fuse_ref_folio() unlocks the request but does not re-lock it before
returning. fuse_chan_abort() can end the request and the async end
callback (eg fuse_writepage_free()) can free the args while the
subsequent copy chain logic after fuse_ref_folio() accesses them,
leading to use-after-free issues.

Fix this by locking the request in fuse_ref_folio() before returning.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 2.6.35 < 5.10.261
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.212
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.178
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.145
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.96
Linux ≫ Linux Kernel Version >= 6.13 < 6.18.39
Linux ≫ Linux Kernel Version >= 6.19 < 7.1.4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.055
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/1f9156714592356b4fda57beac7eab9c2a462dd3
Patch
https://git.kernel.org/stable/c/5630da218a45ba80f0aba0846cbe8aa655da122b
Patch
https://git.kernel.org/stable/c/1ca605cfa59377f0143fb35b5b01360f37d1b7c4
Patch
https://git.kernel.org/stable/c/0e4a5a000123d81234e27a2f8187688cf608f755
Patch
https://git.kernel.org/stable/c/e6aa539720c3d8def69683ed0c07cf9faea4e8be
Patch
https://git.kernel.org/stable/c/be353caffa8640f5e25fb3714ce8b0cef5e410e5
Patch
https://git.kernel.org/stable/c/65a1c2551f7e16085acbb54aedde1feaa559ba7a
Patch
https://git.kernel.org/stable/c/b5befa80fdbe287a98480effed9564712924add5
Patch