The vulnerability arises when the kernel copies data from user space and overwrites an error indicator with a nonnegative residual value. Because the error is stored as a positive number, callers interpret the operation as successful, permitting them to use a partially or uninitialized response. This flaw may allow a local attacker to trick a FUSE client into believing that an operation succeeded when it actually failed, potentially enabling unauthorized actions that rely on the client’s assumptions about the result.

The issue affects Linux kernel implementations that support the FUSE IO uring (fuse-uring) interface. No specific kernel version list is provided; the vulnerability applies to kernels compiled with this feature prior to the fix. System administrators should review the kernel version and configuration to determine if the fuse-uring component is included.

The EPSS score is below 1 percent, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 indicates moderate severity. The flaw requires a local user with the ability to supply crafted FUSE requests; exploitation therefore depends on the existence of a vulnerable user‑space FUSE client that triggers the faulty path. With the available information, the risk remains modest, yet the fixed kernel corrects the error handling to prevent the misuse of incomplete responses.