In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue->stopped races and set/read that value under lock There are several readers of queue->stopped that check the value under lock, but fuse_uring_commit_fetch() did not and actually the value was not set under the lock in fuse_uring_abort_end_requests() either. Especially in fuse_uring_commit_fetch it is important to check under a lock, because due to races 'struct fuse_req' might be freed with fuse_request_end, but another thread/cpu might already do teardown work.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-64260 is a race condition vulnerability in the Linux kernel's FUSE (Filesystem in Userspace) over io_uring implementation. The vulnerability stems from unsynchronized access to the queue->stopped flag, where multiple code paths read this value without proper locking mechanisms. This creates a classic time-of-check-time-of-use (TOCTOU) race condition that could lead to use-after-free scenarios, particularly in fuse_uring_commit_fetch() where struct fuse_req objects might be freed prematurely. The vulnerability affects Linux systems using FUSE with io_uring, impacting container runtimes, userspace filesystems, and distributed storage solutions that depend on FUSE for I/O operations.
While this CVE currently has no mapped MITRE ATT&CK techniques or matching Casky skills, security practitioners using Casky.ai would benefit from the platform's ability to correlate synchronization vulnerabilities with broader attack patterns. By leveraging Claude AI's extended reasoning capabilities across the 754 mapped security skills, practitioners can identify similar race condition patterns in kernel code that may expose T1203 (Exploitation for Privilege Escalation), T1548 (Abuse Elevation Control Mechanism), or T1055 (Process Injection) attack vectors. When analyzing FUSE kernel logs or io_uring system calls, practitioners should look for anomalous freed memory references, unexpected queue state transitions, or segmentation faults occurring in FUSE processing threads—indicators that would surface in findings when monitoring for improper synchronization and kernel memory corruption patterns.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-64260. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation