High 7.8Published Jul 25, 2026

CVE-2026-64266fuse: re-lock request before returning from fuse_ref_folio()

Updated under an hour ago (2026-10-19 10:23 UTC)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_ref_folio() fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async end callback (eg fuse_writepage_free()) can free the args while the subsequent copy chain logic after fuse_ref_folio() accesses them, leading to use-after-free issues. Fix this by locking the request in fuse_ref_folio() before returning.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c3021629a0d820247ee12b6c5192a1d5380e21c6 before 1f9156714592356b4fda57beac7eab9c2a462dd3; from c3021629a0d820247ee12b6c5192a1d5380e21c6 before 5630da218a45ba80f0aba0846cbe8aa655da122b; from c3021629a0d820247ee12b6c5192a1d5380e21c6 before 1ca605cfa59377f0143fb35b5b01360f37d1b7c4; from c3021629a0d820247ee12b6c5192a1d5380e21c6 before 0e4a5a000123d81234e27a2f8187688cf608f755; from c3021629a0d820247ee12b6c5192a1d5380e21c6 before e6aa539720c3d8def69683ed0c07cf9faea4e8be; from c3021629a0d820247ee12b6c5192a1d5380e21c6 before be353caffa8640f5e25fb3714ce8b0cef5e410e5; from c3021629a0d820247ee12b6c5192a1d5380e21c6 before 65a1c2551f7e16085acbb54aedde1feaa559ba7a; from c3021629a0d820247ee12b6c5192a1d5380e21c6 before b5befa80fdbe287a98480effed9564712924add5	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.35 before 5.10.261; from 5.11 before 5.15.212; from 5.16 before 6.1.178; from 6.2 before 6.6.145; from 6.7 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4	NVD

References

https://git.kernel.org/stable/c/1f9156714592356b4fda57beac7eab9c2a462dd3patch
https://git.kernel.org/stable/c/5630da218a45ba80f0aba0846cbe8aa655da122bpatch
https://git.kernel.org/stable/c/1ca605cfa59377f0143fb35b5b01360f37d1b7c4patch
https://git.kernel.org/stable/c/0e4a5a000123d81234e27a2f8187688cf608f755patch
https://git.kernel.org/stable/c/e6aa539720c3d8def69683ed0c07cf9faea4e8bepatch
https://git.kernel.org/stable/c/be353caffa8640f5e25fb3714ce8b0cef5e410e5patch
https://git.kernel.org/stable/c/65a1c2551f7e16085acbb54aedde1feaa559ba7apatch
https://git.kernel.org/stable/c/b5befa80fdbe287a98480effed9564712924add5patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.