CVE-2026-64262: fuse-uring: end fuse_req on io-uring cancel task work

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

fuse-uring: end fuse_req on io-uring cancel task work

When io_uring delivers task work with tw.cancel set (PF_EXITING,
PF_KTHREAD fallback, or percpu_ref_is_dying on the ring context),
fuse_uring_send_in_task() takes the cancel branch, assigns
-ECANCELED, and falls through to fuse_uring_send(). That path only
flips the entry to FRRS_USERSPACE and completes the io_uring cmd;
it never discharges the ring entry's owning reference to the
fuse_req that fuse_uring_add_req_to_ring_ent() handed it at
dispatch time.

    fuse_uring_send_in_task()
      tw.cancel == true
        err = -ECANCELED
      fuse_uring_send(ent, cmd, err, issue_flags)
        ent->state = FRRS_USERSPACE
        list_move(&ent->list, &queue->ent_in_userspace)
        ent->cmd = NULL
        io_uring_cmd_done(-ECANCELED)
        /* ent->fuse_req still set, req still hashed */

The fuse_req stays linked on fpq->processing[hash] and
fuse_request_end() is never invoked. The originating syscall
thread blocks in D-state in request_wait_answer() until
fuse_abort_conn() runs, which can be the entire connection
lifetime. For FR_BACKGROUND requests fc->num_background is never
decremented either, so repeated cancels inflate the counter until
max_background is hit and all later background ops stall. tw.cancel does
not imply a connection abort (e.g. a single io_uring worker thread exits
while the fuse connection stays up), so this cannot be left for
fuse_abort_conn() to clean up.

Ending the req but still routing the entry through fuse_uring_send()
is not enough: that leaves a req-less entry on ent_in_userspace, and
ent_list_request_expired() dereferences ent->fuse_req unconditionally
on the head of that list, which would then NULL-deref.

Fix the cancel branch to release the entry directly. Remove it from the
queue, complete the io_uring cmd, end the fuse_req, free the entry, and
drop its queue_refs (waking the teardown waiter if it was the last).

The Linux kernel CVE team has assigned CVE-2026-64262 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.14 with commit c2c9af9a0b13261c36909036057a116f2edb5e1a and fixed in 6.18.39 with commit bb476ef8e1027a9d509fbaaf81f5061a07e9e5a7
	Issue introduced in 6.14 with commit c2c9af9a0b13261c36909036057a116f2edb5e1a and fixed in 7.1.4 with commit 4f45f276d5b4412eade6f74f2e37f3adba0473ed
	Issue introduced in 6.14 with commit c2c9af9a0b13261c36909036057a116f2edb5e1a and fixed in 7.2-rc1 with commit bea4fe98204b6ce7eb8e29f7bf867dd7619b3ddd

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64262
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/fuse/dev_uring.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/bb476ef8e1027a9d509fbaaf81f5061a07e9e5a7
	https://git.kernel.org/stable/c/4f45f276d5b4412eade6f74f2e37f3adba0473ed
	https://git.kernel.org/stable/c/bea4fe98204b6ce7eb8e29f7bf867dd7619b3ddd