CVE-2026-64265

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req<br /> <br /> When fuse_resend() moves a request from fpq-&gt;processing back to<br /> fiq-&gt;pending, it sets FR_PENDING and clears FR_SENT but does not<br /> remove the requests intr_entry from fiq-&gt;interrupts. If the<br /> request had FR_INTERRUPTED set from a prior signal, intr_entry<br /> remains dangling on fiq-&gt;interrupts. When the requesting task<br /> then receives a fatal signal, fuse_remove_pending_req() sees<br /> FR_PENDING=1, removes the request from fiq-&gt;pending and frees it<br /> via the refcount path, also without cleaning intr_entry. The<br /> stale intr_entry causes use-after-free when fuse_read_interrupt()<br /> iterates fiq-&gt;interrupts:<br /> - list_del_init(&amp;req-&gt;intr_entry) -&gt; UAF write on freed slab<br /> - req-&gt;in.h.unique -&gt; UAF read, data leaked to userspace<br /> <br /> Remove intr_entry from fiq-&gt;interrupts in fuse_resend() for<br /> interrupted requests before they are placed back on fiq-&gt;pending.<br /> <br /> Add a WARN_ON if the intr_entry is not empty on request destruction.