Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-25T00:00:00 kernel: fuse: re-lock request before returning from fuse_ref_folio() 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-825

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_ref_folio() fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async end callback (eg fuse_writepage_free()) can free the args while the subsequent copy chain logic after fuse_ref_folio() accesses them, leading to use-after-free issues. Fix this by locking the request in fuse_ref_folio() before returning.

A flaw was found in the Linux kernel's FUSE (Filesystem in Userspace) component. The `fuse_ref_folio()` function does not properly re-lock a request after unlocking it, which can lead to a use-after-free vulnerability. A local attacker could exploit this flaw to potentially execute arbitrary code or cause a denial of service.

Red Hat Enterprise Linux 10 Affected kernel Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Affected kernel Red Hat Enterprise Linux 7 Affected kernel-rt Red Hat Enterprise Linux 8 Affected kernel Red Hat Enterprise Linux 8 Affected kernel-rt Red Hat Enterprise Linux 9 Affected kernel Red Hat Enterprise Linux 9 Affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-64266 https://nvd.nist.gov/vuln/detail/CVE-2026-64266 https://lore.kernel.org/linux-cve-announce/2026072558-CVE-2026-64266-67e6@gregkh/T