CVE-2026-64258: fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref

If a copy into the userspace ring buffer fails, a request will be
terminated and fuse_uring_req_end() will set ent->fuse_req to NULL but
it will leave the entry on ent_w_req_queue in FRRS_FUSE_REQ state. This
can lead to a NULL deref if the request expiration logic scans
ent_w_req_queue in the window before the entry is moved off it.

Fix this by taking the entry off ent_w_req_queue and changing its state
from FRRS_FUSE_REQ to FRRS_INVALID before terminating the request.

The Linux kernel CVE team has assigned CVE-2026-64258 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.16 with commit 4fea593e625cd50d4d11be227007849b12f17bfb and fixed in 6.18.39 with commit 0b466cf1b96e191b06b496c4de79da15315c3a9a
	Issue introduced in 6.16 with commit 4fea593e625cd50d4d11be227007849b12f17bfb and fixed in 7.1.4 with commit 0a7f33010c0e4cd92937e088a54350381fd0fbf2
	Issue introduced in 6.16 with commit 4fea593e625cd50d4d11be227007849b12f17bfb and fixed in 7.2-rc1 with commit 1c57a69be962d459c5e705f5cb4355b841b3461c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64258
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/fuse/dev_uring.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/0b466cf1b96e191b06b496c4de79da15315c3a9a
	https://git.kernel.org/stable/c/0a7f33010c0e4cd92937e088a54350381fd0fbf2
	https://git.kernel.org/stable/c/1c57a69be962d459c5e705f5cb4355b841b3461c