CVE-2026-64265 is a vulnerability in the Linux kernel's FUSE implementation where fuse_resend() fails to remove the intr_entry from fiq->interrupts when moving a request back to the pending queue if the request was previously interrupted. This results in a dangling pointer that causes use-after-free when fuse_read_interrupt() iterates over fiq->interrupts, leading to both read and write use-after-free conditions. The flaw allows potential data leakage to userspace and memory corruption. The fix involves removing the intr_entry before placing the request back on the pending queue and adding a WARN_ON check on request destruction to detect non-empty intr_entry.

The vulnerability allows use-after-free conditions in kernel memory, which can lead to memory corruption and data leakage to userspace. The CVSS score of 7.8 indicates high confidentiality, integrity, and availability impact, but the attack vector is local with low privileges required and no user interaction. There are no known exploits in the wild at this time.

A fix has been implemented in the Linux kernel to properly clear the intr_entry in fuse_resend() and fuse_remove_pending_req(). Users should apply the official kernel updates that include this patch. Since this is a kernel-level vulnerability, upgrading to a patched kernel version is the recommended remediation. No additional mitigations are specified.