Linux kernel fuse: request left unlocked on return from fuse_ref_folio(), allowing a use-after-free

Impact

fuse_ref_folio() unlocks the request and does not re-lock it before returning. fuse_chan_abort() can then end the request and the async end callback (for example fuse_writepage_free()) can free the args while the copy chain after fuse_ref_folio() is still reading them - a use-after-free in core FUSE. FUSE is ordinary infrastructure on GPU nodes: object-store and parallel-filesystem clients, container image mounts, and dataset loaders all use it, and unprivileged user namespaces let a tenant drive both sides of the channel. That makes the abort race reachable by a local workload rather than only by the storage admin.

Who can reach it

Local user able to mount or serve a FUSE filesystem, including a tenant with unprivileged user namespaces enabled in its container. The race is driven by aborting the FUSE channel while I/O is in flight.

What to do

Apply the stable fix that re-locks the request in fuse_ref_folio() and reboot the node. As an interim measure, disable unprivileged FUSE mounts for tenant workloads where the storage stack does not require them.

References

Related entries

• Linux kernel iommufd: pointer-sized bound check in veventq read can write past the user bufferCVE-2026-64293 · Linux kernel iommufd vEVENT queue read (iommufd_veventq_fops_read)High
• Linux kernel perf AUX buffer: missing aux_mutex in map_range lets a local user map a freed pageCVE-2026-64300 · Linux kernel perf ring buffer AUX area (map_range / rb_alloc_aux locking)High
• Linux kernel QAT crypto driver: oversized RSA CRT components overflow half-size DMA buffersCVE-2026-64304 · Linux kernel crypto qat driver (RSA CRT key setup, qat_rsa_setkey_crt)High
• Linux kernel Intel QAT: unlocked service_table walks can corrupt the list or use freed entriesCVE-2026-64305 · Linux kernel Intel QAT driver (adf service_table list locking)High
• Linux kernel BPF: LPM trie RCU annotations reject sleepable programs and spam lockdep warningsCVE-2026-64352 · Linux kernel BPF LPM trie (RCU annotations for sleepable programs)High
• Linux BPF: BTF repeated-field count overflow allows an out-of-bounds write on BPF_BTF_LOADCVE-2026-64354 · Linux kernel BPF BTF parser (btf_repeat_fields expansion)High