CVE-2026-80946

fuse: copy request headers via a stack buffer for io-uring

Published Sep 11, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

fuse: copy request headers via a stack buffer for io-uring

The fuse-io-uring transport copies req->in.h out to the ring in
fuse_uring_copy_to_ring() and req->out.h back in fuse_uring_commit().
Both headers live inside the fuse_request slab object, whose cache
(fuse_req_cachep) is created without a usercopy whitelist, so copying
them directly to/from userspace trips CONFIG_HARDENED_USERCOPY and
panics:

usercopy: Kernel memory exposure attempt detected from SLUB object
'fuse_request' (offset 56, size 40)!
kernel BUG at mm/usercopy.c:102!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:usercopy_abort (mm/usercopy.c:90)
Call Trace:
__check_heap_object (mm/slub.c:8268)
__check_object_size (mm/usercopy.c:197 mm/usercopy.c:258 mm/usercopy.c:223)
copy_header_to_ring (fs/fuse/dev_uring.c:618)
fuse_uring_prepare_send (fs/fuse/dev_uring.c:776 fs/fuse/dev_uring.c:785)
fuse_uring_send_in_task (fs/fuse/dev_uring.c:1306)
tctx_task_work_run (io_uring/tw.c:96)
task_work_run (kernel/task_work.c:233)
io_run_task_work (io_uring/tw.h:84)
io_cqring_wait (io_uring/wait.c:278)
__do_sys_io_uring_enter (io_uring/io_uring.c:2685)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

Bounce both headers through an on-stack copy so the usercopy touches
stack memory, not the slab object.

Analysis

Technical impact

The vulnerability arises in the Linux kernel’s FUSE io‑uring transport when the code copies request headers directly from the fuse_request slab into user space. Because the slab cache was created without a usercopy whitelist, the_USERCOPY protection and triggers a kernel BUG, leading to a to become unavailable if, effectively providing a denial‑of‑service vector.

Affected Systems

All Linux kernel versions that contain the unpatched fuse io‑uring header copy logic are impacted. The issue affects every distribution that ships a fresh Linux kernel with the FUSE module and io‑uring support enabled, until the patch that records a safe on‑stack copy of the headers is merged.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to be able to generate or manipulate FUSE io‑uring requests on the local system, a privilege typically associated with local or privileged access. If these conditions are met, the system may repeatedly crash, resulting in a denial‑of‑service situation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c090c8abae4b6b77a1bee116aa6c385456ebef96`	affected	< 194d0fb0ea4720535ff3168c9d04c7632cec7071
`c090c8abae4b6b77a1bee116aa6c385456ebef96`	affected	< a47a416ff68d706dc3327ab583f86b9ee757358b
`c090c8abae4b6b77a1bee116aa6c385456ebef96`	affected	< fd10f40af314f07b6d6e028b1ca25c8b49903aab

Linux

affected

Version	Status	Constraints
`6.14`	affected	—
`0`	unaffected	< 6.14
`6.18.51`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[c090c8abae4b6b77a1bee116aa6c385456ebef96,194d0fb0ea4720535ff3168c9d04c7632cec7071)`	affected	code_commit	—
`[c090c8abae4b6b77a1bee116aa6c385456ebef96,a47a416ff68d706dc3327ab583f86b9ee757358b)`	affected	code_commit	—
`[c090c8abae4b6b77a1bee116aa6c385456ebef96,fd10f40af314f07b6d6e028b1ca25c8b49903aab)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[6.14,6.14]`	affected	generic	—
`[0,6.14)`	unaffected	generic	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that contains the fuse_uring copy fix.
Disable io‑uring support for the FUSE module until an updated kernel is deployed.
If upgrade or disabling io‑uring is not immediately feasible rapid reboot or migration to a non‑FUSE filesystem to avoid prolonged downtime.

Generated by OpenCVE AI on September 21, 2026 at 02:53 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.166% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/194d0fb0ea4720535ff3168c9d04c7632cec7071
https://git.kernel.org/stable/c/a47a416ff68d706dc3327ab583f86b9ee757358b
https://git.kernel.org/stable/c/fd10f40af314f07b6d6e028b1ca25c8b49903aab
https://nvd.nist.gov/vuln/detail/CVE-2026-80946
https://www.cve.org/CVERecord?id=CVE-2026-80946

History

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-501
References		https://nvd.nist.gov/vuln/detail/CVE-2026-80946 https://www.cve.org/CVERecord?id=CVE-2026-80946
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req->in.h out to the ring in fuse_uring_copy_to_ring() and req->out.h back in fuse_uring_commit(). Both headers live inside the fuse_request slab object, whose cache (fuse_req_cachep) is created without a usercopy whitelist, so copying them directly to/from userspace trips CONFIG_HARDENED_USERCOPY and panics: usercopy: Kernel memory exposure attempt detected from SLUB object 'fuse_request' (offset 56, size 40)! kernel BUG at mm/usercopy.c:102! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:usercopy_abort (mm/usercopy.c:90) Call Trace: __check_heap_object (mm/slub.c:8268) __check_object_size (mm/usercopy.c:197 mm/usercopy.c:258 mm/usercopy.c:223) copy_header_to_ring (fs/fuse/dev_uring.c:618) fuse_uring_prepare_send (fs/fuse/dev_uring.c:776 fs/fuse/dev_uring.c:785) fuse_uring_send_in_task (fs/fuse/dev_uring.c:1306) tctx_task_work_run (io_uring/tw.c:96) task_work_run (kernel/task_work.c:233) io_run_task_work (io_uring/tw.h:84) io_cqring_wait (io_uring/wait.c:278) __do_sys_io_uring_enter (io_uring/io_uring.c:2685) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Bounce both headers through an on-stack copy so the usercopy touches stack memory, not the slab object.
Title		fuse: copy request headers via a stack buffer for io-uring
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/194d0fb0ea4720535ff3168c9d04c7632cec7071 https://git.kernel.org/stable/c/a47a416ff68d706dc3327ab583f86b9ee757358b https://git.kernel.org/stable/c/fd10f40af314f07b6d6e028b1ca25c8b49903aab