CVE-2026-64262 fuse-uring: end fuse_req on io-uring cancel task work

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fusereq on io-uring cancel task work When iouring delivers task work with tw.cancel set PFEXITING, PFKTHREAD fallback, or percpurefisdying on the ring context, fuseuringsendintask takes the cancel branch, assigns...

CVE-2026-64262

CVE-2026-64262 is a Linux kernel vulnerability in the fuse-uring path. When io_uring task work with tw.cancel set is delivered, fuse_uring_send_in_task() follows the cancel branch, assigns -ECANCELED, and proceeds to fuse_uring_send() without discharging the fuse_req. This leaves ent and the fuse...