{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.96-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.4-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req  When fuse_resend() moves a request from fpq-\u003eprocessing back to fiq-\u003epending, it sets FR_PENDING and clears FR_SENT but does not remove the requests intr_entry from fiq-\u003einterrupts.  If the request had FR_INTERRUPTED set from a prior signal, intr_entry remains dangling on fiq-\u003einterrupts.  When the requesting task then receives a fatal signal, fuse_remove_pending_req() sees FR_PENDING=1, removes the request from fiq-\u003epending and frees it via the refcount path, also without cleaning intr_entry.  The stale intr_entry causes use-after-free when fuse_read_interrupt() iterates fiq-\u003einterrupts:   - list_del_init(\u0026req-\u003eintr_entry) -\u003e UAF write on freed slab   - req-\u003ein.h.unique -\u003e UAF read, data leaked to userspace  Remove intr_entry from fiq-\u003einterrupts in fuse_resend() for interrupted requests before they are placed back on fiq-\u003epending.  Add a WARN_ON if the intr_entry is not empty on request destruction.",
  "id": "DEBIAN-CVE-2026-64265",
  "modified": "2026-09-14T16:47:47.653031034Z",
  "published": "2026-07-25T10:17:06.667Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-64265"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-64265"
  ]
}