Linux Kernel CVE-2026-64588

The fuse-uring subsystem provides an io_uring-backed interface for FUSE (Filesystem in Userspace) in the Linux kernel, allowing userspace filesystem operations to be served through the high-performance io_uring ring buffer model. The subsystem uses a ring->ready flag to signal that fiq->ops - the FUSE I/O queue operations function pointer table - is safe to use for dispatching requests. On weakly-ordered CPU architectures such as ARM64, PowerPC, and RISC-V, the absence of proper memory barriers permits the compiler or CPU to reorder stores: ring->ready can become visible to other CPUs before fiq->ops is fully propagated, creating a window where fuse_uring_ready() returns true but a subsequent dispatch dereferences a stale or uninitialized fiq->ops pointer. A secondary issue was a KCSAN-flagged marked-vs-unmarked access where WRITE_ONCE(ring->ready) was paired with a plain load on the fast path. The fix introduces smp_store_release()/smp_load_acquire() pairs and READ_ONCE() wrappers. No CWE is formally assigned, but this maps to CWE-362 (Race Condition / Concurrent Access to Shared Resource Without Proper Synchronization) and CWE-1088 (Synchronization Primitive Not Used or Incorrectly Used). Affected CPE: cpe:2.3:a:linux:linux:*.