Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Linux Linux — fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L L N U N N H 5.5 .0015 5.0 —
AFFECTED
Product Versions Fixed
Linux 4fea593e625cd50d4d11be227007849b12f17bfb – —
Linux 6.16 – 6.18.39
TIMELINE
Jul 19 Reserved by Linux
Jul 25 Published (CNA: Linux)
Aug 17 ENRICHED — CVE-2026-64258 (Linux). Received CVSS 5.5 and CPE data from NVD.
Description
In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref
If a copy into the userspace ring buffer fails, a request will be
terminated and fuse_uring_req_end() will set ent->fuse_req to NULL but
it will leave the entry on ent_w_req_queue in FRRS_FUSE_REQ state. This
can lead to a NULL deref if the request expiration logic scans
ent_w_req_queue in the window before the entry is moved off it.
Fix this by taking the entry off ent_w_req_queue and changing its state
from FRRS_FUSE_REQ to FRRS_INVALID before terminating the request.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| July 19, 2026 | Reserved | Reserved by Linux |
| July 25, 2026 | Published | Published (CNA: Linux) |
| August 17, 2026 | ENRICHED | ENRICHED — CVE-2026-64258 (Linux). Received CVSS 5.5 and CPE data from NVD. |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Linux | Linux | — | 4fea593e625cd50d4d11be227007849b12f17bfb | — |
| Linux | Linux | — | 6.16 | 6.18.39 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-64258 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.