UBUNTU-CVE-2026-64260

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue-stopped races and set/read that value under lock There are several readers of queue-stopped that check the value under lock, but fuseuringcommitfetch did not and actually the value was not set under the lo...

UBUNTU-CVE-2026-64263

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to entinuserspace list fuseuringcancel moves entries that are available these have no reqs attached to the entinuserspace list. entlistrequestexpired checks the first entry on entinuserspace...

CVE-2026-64258

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

CVE-2026-64259

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...

UBUNTU-CVE-2026-64262

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fusereq on io-uring cancel task work When iouring delivers task work with tw.cancel set PFEXITING, PFKTHREAD fallback, or percpurefisdying on the ring context, fuseuringsendintask takes the cancel branch, assigns...

UBUNTU-CVE-2026-64264

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuseoutheader. fuseuringcommit stores that residual in ssizet err, sets...

UBUNTU-CVE-2026-64261

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuseuringasyncstopqueues fuseuringasyncstopqueues might run when the last reference on ring-queuerefs was already dropped. In order to avoid an early destruction a reference on struct fuseconn ...

CVE-2026-64264

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuseoutheader. fuseuringcommit stores that residual in ssizet err, sets...

CVE-2026-64263

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to entinuserspace list fuseuringcancel moves entries that are available these have no reqs attached to the entinuserspace list. entlistrequestexpired checks the first entry on entinuserspace...

CVE-2026-64260

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue-stopped races and set/read that value under lock There are several readers of queue-stopped that check the value under lock, but fuseuringcommitfetch did not and actually the value was not set under the lo...

CVE-2026-64263 fuse-uring: fix moving cancelled entry to ent_in_userspace list

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to entinuserspace list fuseuringcancel moves entries that are available these have no reqs attached to the entinuserspace list. entlistrequestexpired checks the first entry on entinuserspace...

CVE-2026-64263

CVE-2026-64263 affects the Linux kernel fuse-uring component. The issue arises when cancelled entries moved to ent_in_userspace are dereferenced by ent_list_request_expired(), causing a crash. The fix updates fuse_uring_cancel() to free the cancelled entry and drop queue_refs directly, ensuring s...

CVE-2026-64263

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to entinuserspace list fuseuringcancel moves entries that are available these have no reqs attached to the entinuserspace list. entlistrequestexpired checks the first entry on entinuserspace...

CVE-2026-64263 fuse-uring: fix moving cancelled entry to ent_in_userspace list

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to entinuserspace list fuseuringcancel moves entries that are available these have no reqs attached to the entinuserspace list. entlistrequestexpired checks the first entry on entinuserspace...

CVE-2026-64264 fuse-uring: fix EFAULT clobber in fuse_uring_commit

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuseoutheader. fuseuringcommit stores that residual in ssizet err, sets...

EUVD-2026-48975

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to entinuserspace list fuseuringcancel moves entries that are available these have no reqs attached to the entinuserspace list. entlistrequestexpired checks the first entry on entinuserspace...

CVE-2026-64264 fuse-uring: fix EFAULT clobber in fuse_uring_commit

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuseoutheader. fuseuringcommit stores that residual in ssizet err, sets...

CVE-2026-64264

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuseuringcommit copyfromuser returns the number of bytes not copied as an unsigned residual on failure 1..sizeofstruct fuseoutheader. fuseuringcommit stores that residual in ssizet err, sets...

CVE-2026-64262 fuse-uring: end fuse_req on io-uring cancel task work

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fusereq on io-uring cancel task work When iouring delivers task work with tw.cancel set PFEXITING, PFKTHREAD fallback, or percpurefisdying on the ring context, fuseuringsendintask takes the cancel branch, assigns...

CVE-2026-64262

CVE-2026-64262 is a Linux kernel vulnerability in the fuse-uring path. When io_uring task work with tw.cancel set is delivered, fuse_uring_send_in_task() follows the cancel branch, assigns -ECANCELED, and proceeds to fuse_uring_send() without discharging the fuse_req. This leaves ent and the fuse...