CVE-2026-64263

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fuse-uring: fix moving cancelled entry to ent_in_userspace list<br /> <br /> fuse_uring_cancel() moves entries that are available (these have no reqs<br /> attached) to the ent_in_userspace list. ent_list_request_expired()<br /> checks the first entry on ent_in_userspace and dereferences<br /> ent-&gt;fuse_req unconditionally, which will crash on a cancelled entry<br /> that was moved to this list.<br /> <br /> Fix this by freeing the entry and dropping queue_refs directly in<br /> fuse_uring_cancel(). This is safe because cancel is the cancel handler<br /> itself - after io_uring_cmd_done(), no more cancels will be dispatched<br /> for this command, and teardown serializes with cancel via queue-&gt;lock.<br /> <br /> Since cancel now decrements queue_refs, fuse_uring_abort() must no<br /> longer gate fuse_uring_abort_end_requests() on queue_refs &gt; 0, as<br /> cancelled entries may have already dropped queue_refs while requests are<br /> still queued. Remove the gate so abort always flushes requests and stops<br /> queues.