In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req When fuse_resend() moves a request from fpq->processing back to fiq->pending, it sets FR_PENDING and clears FR_SENT but does not remove the requests intr_entry from fiq->interrupts. If the request had FR_INTERRUPTED set from a prior signal, intr_entry remains dangling on fiq->interrupts. When the requesting task then receives a fatal signal, fuse_remove_pending_req() sees FR_PENDING=1, removes the request from fiq->pending and frees it via the refcount path, also without cleaning intr_entry. The stale intr_entry causes use-after-free when fuse_read_interrupt() iterates fiq->interrupts: - list_del_init(&req->intr_entry) -> UAF write on freed slab - req->in.h.unique -> UAF read, data leaked to userspace Remove intr_entry from fiq->interrupts in fuse_resend() for interrupted requests before they are placed back on fiq->pending. Add a WARN_ON if t
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-64265 is a memory safety vulnerability in the Linux kernel's FUSE (Filesystem in Userspace) subsystem that occurs when request handling fails to properly clean up interrupt list entries during request resend operations. When fuse_resend() moves a request from processing back to pending state, it neglects to remove the request's intr_entry from the interrupts list if the request was previously marked as interrupted. This leaves a dangling pointer on the list that can be dereferenced when the requesting task receives a fatal signal, leading to potential kernel memory corruption, denial of service, or privilege escalation. Any system running vulnerable Linux kernel versions with FUSE enabled is affected, particularly affecting container environments, sandboxing systems, and user-space filesystem implementations that depend on FUSE for operation.
While CVE-2026-64265 currently maps to zero MITRE ATT&CK techniques and zero Casky skills, practitioners monitoring for exploitation would detect attack patterns associated with T1499 (Service Exhaustion Denial of Service) through kernel crash logs and system instability, T1548 (Abuse Elevation Control Mechanism) if attackers leverage the corruption for privilege escalation, and T1104 (Multi-stage Channels) patterns in FUSE request traffic analysis. Detection would manifest as unexpected kernel panics, hung processes in uninterruptible sleep states, memory corruption indicators in kernel logs, and abnormal FUSE message sequencing in audit trails. Security teams should monitor for repeated fatal signal delivery to processes with active FUSE requests, kernel bug reports related to fuse_resend operations, and anomalous process termination patterns that correlate with FUSE filesystem activity.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-64265. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation