The Linux kernel fuse-uring subsystem had a data race on the ring->ready flag on weakly-ordered architectures. Specifically, stores to fiq->ops could be reordered past ring->ready, allowing CPUs that observe ring->ready as true to dispatch requests using a stale fiq->ops pointer. This was fixed by upgrading the store to smp_store_release() and the load in fuse_uring_ready() to smp_load_acquire(), ensuring proper memory visibility ordering. Additional fixes involved marking accesses with READ_ONCE() to prevent compiler reordering. The vulnerability is tracked as CVE-2026-64588 and affects Linux kernel versions prior to 7.0.0-31.31 and related variants. The issue is part of a broader set of Linux kernel security fixes addressing multiple subsystems and architectures.

A local attacker on affected Linux systems could exploit this data race to dispatch requests through stale pointers, potentially leading to privilege escalation or system compromise. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. However, exploitation requires local access and low complexity, with no user interaction needed.

An official patch is available and should be applied promptly. The vendor advisory from Ubuntu confirms that updating to Linux kernel versions 7.0.0-31.31 or later (and related patched builds) resolves the issue. After updating, a system reboot is required. Additionally, due to ABI changes, third-party kernel modules must be recompiled and reinstalled. Follow vendor instructions for updating and recompiling modules to fully mitigate the vulnerability.