CVE-2026-64266

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_ref_folio() fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async end callback (eg fuse_writepage_free()) can free the args while the subsequent copy chain logic after fuse_ref_folio() accesses them, leading to use-after-free issues. Fix this by locking the request in fuse_ref_folio() before returning.

• linux linux kernel (>= 2.6.35 < 5.10.261) • linux linux kernel (>= 5.11 < 5.15.212) • linux linux kernel (>= 5.16 < 6.1.178) • linux linux kernel (>= 6.2 < 6.6.145) • linux linux kernel (>= 6.7 < 6.12.96) • linux linux kernel (>= 6.13 < 6.18.39) • linux linux kernel (>= 6.19 < 7.1.4)