CVE-2026-64262

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fuse-uring: end fuse_req on io-uring cancel task work<br /> <br /> When io_uring delivers task work with tw.cancel set (PF_EXITING,<br /> PF_KTHREAD fallback, or percpu_ref_is_dying on the ring context),<br /> fuse_uring_send_in_task() takes the cancel branch, assigns<br /> -ECANCELED, and falls through to fuse_uring_send(). That path only<br /> flips the entry to FRRS_USERSPACE and completes the io_uring cmd;<br /> it never discharges the ring entry&amp;#39;s owning reference to the<br /> fuse_req that fuse_uring_add_req_to_ring_ent() handed it at<br /> dispatch time.<br /> <br /> fuse_uring_send_in_task()<br /> tw.cancel == true<br /> err = -ECANCELED<br /> fuse_uring_send(ent, cmd, err, issue_flags)<br /> ent-&gt;state = FRRS_USERSPACE<br /> list_move(&amp;ent-&gt;list, &amp;queue-&gt;ent_in_userspace)<br /> ent-&gt;cmd = NULL<br /> io_uring_cmd_done(-ECANCELED)<br /> /* ent-&gt;fuse_req still set, req still hashed */<br /> <br /> The fuse_req stays linked on fpq-&gt;processing[hash] and<br /> fuse_request_end() is never invoked. The originating syscall<br /> thread blocks in D-state in request_wait_answer() until<br /> fuse_abort_conn() runs, which can be the entire connection<br /> lifetime. For FR_BACKGROUND requests fc-&gt;num_background is never<br /> decremented either, so repeated cancels inflate the counter until<br /> max_background is hit and all later background ops stall. tw.cancel does<br /> not imply a connection abort (e.g. a single io_uring worker thread exits<br /> while the fuse connection stays up), so this cannot be left for<br /> fuse_abort_conn() to clean up.<br /> <br /> Ending the req but still routing the entry through fuse_uring_send()<br /> is not enough: that leaves a req-less entry on ent_in_userspace, and<br /> ent_list_request_expired() dereferences ent-&gt;fuse_req unconditionally<br /> on the head of that list, which would then NULL-deref.<br /> <br /> Fix the cancel branch to release the entry directly. Remove it from the<br /> queue, complete the io_uring cmd, end the fuse_req, free the entry, and<br /> drop its queue_refs (waking the teardown waiter if it was the last).