Advisory [CVE-2026-64260] Avoid queue->stopped races and set/read that value under lock

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue->stopped races and set/read that value under lock There are several readers of queue->stopped that check the value under lock, but fuse_uring_commit_fetch() did not and actually the value was not set under the lock in fuse_uring_abort_end_requests() either.

Especially in fuse_uring_commit_fetch it is important to check under a lock, because due to races 'struct fuse_req' might be freed with fuse_request_end, but another thread/cpu might already do teardown work. A race condition exists where the `queue->stopped` flag is not consistently checked under a lock.

This can allow a `struct fuse_req` to be prematurely freed while other operations are still in progress, potentially leading to memory corruption. A local attacker could exploit this vulnerability to cause system instability or potentially escalate privileges.

Red Hat severity: not rated. Weakness: CWE-413.

Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.