CVE-2026-80946
Received Received - Intake

Heap-based Usercopy Bypass in Linux Kernel FUSE

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req->in.h out to the ring in fuse_uring_copy_to_ring() and req->out.h back in fuse_uring_commit(). Both headers live inside the fuse_request slab object, whose cache (fuse_req_cachep) is created without a usercopy whitelist, so copying them directly to/from userspace trips CONFIG_HARDENED_USERCOPY and panics: usercopy: Kernel memory exposure attempt detected from SLUB object 'fuse_request' (offset 56, size 40)! kernel BUG at mm/usercopy.c:102! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:usercopy_abort (mm/usercopy.c:90) Call Trace: __check_heap_object (mm/slub.c:8268) __check_object_size (mm/usercopy.c:197 mm/usercopy.c:258 mm/usercopy.c:223) copy_header_to_ring (fs/fuse/dev_uring.c:618) fuse_uring_prepare_send (fs/fuse/dev_uring.c:776 fs/fuse/dev_uring.c:785) fuse_uring_send_in_task (fs/fuse/dev_uring.c:1306) tctx_task_work_run (io_uring/tw.c:96) task_work_run (kernel/task_work.c:233) io_run_task_work (io_uring/tw.h:84) io_cqring_wait (io_uring/wait.c:278) __do_sys_io_uring_enter (io_uring/io_uring.c:2685) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Bounce both headers through an on-stack copy so the usercopy touches stack memory, not the slab object.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-80946
EUVD
EUVD-2026-76269

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the fuse-io-uring transport copying request headers directly from a slab object to userspace. The slab object lacks a usercopy whitelist, triggering CONFIG_HARDENED_USERCOPY checks and causing a kernel panic due to memory exposure attempts.

Detection Guidance

This vulnerability is specific to the Linux kernel's FUSE subsystem with io-uring support. Detection requires checking kernel logs for usercopy abort messages or kernel panics related to 'fuse_request' slab objects. Monitor system logs for errors like 'usercopy: Kernel memory exposure attempt detected from SLUB object fuse_request'.

Impact Analysis

This vulnerability can cause system crashes (kernel panics) when using fuse with io-uring, potentially leading to denial-of-service conditions. It may also expose kernel memory contents to userspace, posing security risks.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve this issue. If patches are unavailable, disable the FUSE io-uring transport by setting 'fuse_dev_uring=0' in kernel parameters or unloading the fuse module if not in use. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80946. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart