From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 53A2F3E3C4F for ; Thu, 6 Aug 2026 07:14:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786000458; cv=none; b=UrZfznO8ERfT1xlHeghbhlGgLEmDs6PW/9+VR340I+Ywl78KgoaEdKbCf7HV12oKBO0AlPB4GHHilxu5KUy2ljn4rdjEK3XYedOb7EkRyQs14ohhGxKJ1CmZ7opkd8cMFRNuwE0btIxrA1eRyt2n5E8CjZf9i2zsV88fVpAQYMY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786000458; c=relaxed/simple; bh=U5e6qrD2ubwKsjIHkQKDUgs3X/OdWbGJoCQdNMp4n20=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=FGeHqI3AbzIICXkD8LRDHV1g0iHUcv8tSbytAshne5Mp342Qs+VOJDBettNTfE4tljhC5dFZfEwVJgHvEfTCXksvS/3ld5tXFZH2fiWa7anlxf604SaoJc9mgsoix5GpBVkzCd2QtNyvD8woyy8Nuk8HqxM55k1C3zxD7qUu8tY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=N39yggqg; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="N39yggqg" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 787721F000E9; Thu, 6 Aug 2026 07:14:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786000457; bh=ZLYoxOH+9kNLigJUOyPlrzm3EJldwxmus8smDCHj3Uc=; h=From:To:Cc:Subject:Date:Reply-To; b=N39yggqg1PPduoCSPMhpgC8KPIDktIb322U4H/hAyehmncuG94ONA9DcSctwMZOFf dEDW8yHrrUdV2aMEL4Xi7CKgzYB9fvddYdxAFPNfY4JnbJIL32JVU4YtaamNNgeLYZ TO+w6O0VXo5jEborG9f5db/Zllb2phpwI7swZHJo= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64588: fuse-uring: fix data races on ring->ready Date: Thu, 6 Aug 2026 09:13:51 +0200 Message-ID: <2026080650-CVE-2026-64588-90c7@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2855; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=LVzSdZxoVrS2bcyF77VXG4m0BiwDUQKkuX303+d8YQc=; b=owGbwMvMwCRo6H6F97bub03G02pJDFklJno6QTubJC6zXXwfYL/ksG6ahqyYrVDerDsqz57oM AowL1vVEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABOZdJlhfvQC7gnJneINfbmd tu8S63e+/WAwiWHBvrP8bndcM5xay7M2VPd954+LO/gEAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix data races on ring->ready On weakly-ordered architectures, the store to fiq->ops can be reordered past the store to ring->ready, allowing a CPU that sees ring->ready == true via fuse_uring_ready() to dispatch requests through a stale fiq->ops pointer. Upgrade the store to smp_store_release() and the load in fuse_uring_ready() to smp_load_acquire() so that the preceding WRITE_ONCE(fiq->ops, ...) is visible to any CPU that observes ring->ready == true. Additionally, fuse_uring_do_register() publishes ring->ready with WRITE_ONCE() but the fast-path check reads it with a plain load. This is a marked-vs-unmarked access that KCSAN will flag. Wrap it in READ_ONCE() to mark it without adding unnecessary ordering. Also wrap the fc->ring load in fuse_uring_ready() in READ_ONCE() to prevent the compiler from reloading it between the NULL check and the dereference. The Linux kernel CVE team has assigned CVE-2026-64588 to this issue. Affected and fixed versions =========================== Issue introduced in 6.14 with commit c2c9af9a0b13261c36909036057a116f2edb5e1a and fixed in 6.18.39 with commit b156bb9966972122b148acab8bdf415cdb8176a3 Issue introduced in 6.14 with commit c2c9af9a0b13261c36909036057a116f2edb5e1a and fixed in 7.1.4 with commit d01a09b442cb786cd44ccc7c84d57e2856d6737c Issue introduced in 6.14 with commit c2c9af9a0b13261c36909036057a116f2edb5e1a and fixed in 7.2-rc1 with commit 46725a0056c884cf58a6897f222892807327d82d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64588 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/fuse/dev_uring.c fs/fuse/dev_uring_i.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/b156bb9966972122b148acab8bdf415cdb8176a3 https://git.kernel.org/stable/c/d01a09b442cb786cd44ccc7c84d57e2856d6737c https://git.kernel.org/stable/c/46725a0056c884cf58a6897f222892807327d82d