CVE-2026-64588 is a vulnerability in Linux Kernel
Published on August 6, 2026
fuse-uring: fix data races on ring->ready
In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: fix data races on ring->ready
On weakly-ordered architectures, the store to fiq->ops can be
reordered past the store to ring->ready, allowing a CPU that sees
ring->ready == true via fuse_uring_ready() to dispatch requests
through a stale fiq->ops pointer. Upgrade the store to
smp_store_release() and the load in fuse_uring_ready() to
smp_load_acquire() so that the preceding WRITE_ONCE(fiq->ops, ...)
is visible to any CPU that observes ring->ready == true.
Additionally, fuse_uring_do_register() publishes ring->ready with
WRITE_ONCE() but the fast-path check reads it with a plain load.
This is a marked-vs-unmarked access that KCSAN will flag. Wrap it in
READ_ONCE() to mark it without adding unnecessary ordering.
Also wrap the fc->ring load in fuse_uring_ready() in READ_ONCE() to
prevent the compiler from reloading it between the NULL check and the
dereference.
Products Associated with CVE-2026-64588
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version c2c9af9a0b13261c36909036057a116f2edb5e1a and below b156bb9966972122b148acab8bdf415cdb8176a3 is affected.
- Version c2c9af9a0b13261c36909036057a116f2edb5e1a and below d01a09b442cb786cd44ccc7c84d57e2856d6737c is affected.
- Version c2c9af9a0b13261c36909036057a116f2edb5e1a and below 46725a0056c884cf58a6897f222892807327d82d is affected.
- Version 6.14 is affected.
- Before 6.14 is unaffected.
- Version 6.18.39, <= 6.18.* is unaffected.
- Version 7.1.4, <= 7.1.* is unaffected.
- Version 7.2-rc1, <= * is unaffected.