Advisory [CVE-2026-64261] Avoid use-after-free in fuse_uring_async_stop_queues

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues fuse_uring_async_stop_queues() might run when the last reference on ring->queue_refs was already dropped.

In order to avoid an early destruction a reference on struct fuse_conn is now taken before starting fuse_uring_async_stop_queues() and that reference is only released when that delayed work queue terminates. This use-after-free vulnerability allows a local attacker to potentially achieve privilege escalation.

The issue arises when the `fuse_uring_async_stop_queues()` function attempts to access memory that has already been freed, leading to unpredictable system behavior or unauthorized access. This flaw is mitigated by ensuring that a proper reference to the `fuse_conn` structure is maintained until the associated work queue has fully terminated.

Red Hat severity: not rated. Weakness: CWE-825.

Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images as not affected.