In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues fuse_uring_async_stop_queues() might run when the last reference on ring->queue_refs was already dropped. In order to avoid an early destruction a reference on struct fuse_conn is now taken before starting fuse_uring_async_stop_queues() and that reference is only released when that delayed work queue terminates.

A flaw was found in the Linux kernel's `fuse-uring` component. This use-after-free vulnerability allows a local attacker to potentially achieve privilege escalation. The issue arises when the `fuse_uring_async_stop_queues()` function attempts to access memory that has already been freed, leading to unpredictable system behavior or unauthorized access. This flaw is mitigated by ensuring that a proper reference to the `fuse_conn` structure is maintained until the associated work queue has fully terminated.

Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt Red Hat Hardened Images Not affected erlang27 https://www.cve.org/CVERecord?id=CVE-2026-64261 https://nvd.nist.gov/vuln/detail/CVE-2026-64261 https://lore.kernel.org/linux-cve-announce/2026072557-CVE-2026-64261-71c6@gregkh/T