Linux Kernel EUVD-2026-48975

fuse-uring is a Linux kernel subsystem introduced in kernel 6.16 that integrates FUSE (Filesystem in Userspace) with io_uring for high-performance asynchronous I/O. The affected code path involves the cancellation handler fuse_uring_cancel() and the expiry checker ent_list_request_expired(). When an io_uring command is cancelled for an 'available' entry - one that has no fuse_req attached - the cancel handler moves that entry to the ent_in_userspace list. The expiry checker then reads the first entry on that list and dereferences ent->fuse_req without a NULL guard, producing a kernel NULL pointer dereference and system crash. The fix restructures the cancel handler to free the entry and drop queue_refs directly rather than relocating it, and removes the queue_refs gate in fuse_uring_abort() that incorrectly prevented request flushing when queue_refs had already been decremented by cancelled entries. Affected CPE: cpe:2.3:a:linux:linux:*. No CWE was formally assigned, but the root cause class is a missing NULL check following a state transition in a complex async cancellation path.