{"id":"CVE-2026-80946","summary":"fuse: copy request headers via a stack buffer for io-uring","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: copy request headers via a stack buffer for io-uring\n\nThe fuse-io-uring transport copies req-\u003ein.h out to the ring in\nfuse_uring_copy_to_ring() and req-\u003eout.h back in fuse_uring_commit().\nBoth headers live inside the fuse_request slab object, whose cache\n(fuse_req_cachep) is created without a usercopy whitelist, so copying\nthem directly to/from userspace trips CONFIG_HARDENED_USERCOPY and\npanics:\n\n  usercopy: Kernel memory exposure attempt detected from SLUB object\n  'fuse_request' (offset 56, size 40)!\n  kernel BUG at mm/usercopy.c:102!\n  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n  RIP: 0010:usercopy_abort (mm/usercopy.c:90)\n  Call Trace:\n   __check_heap_object (mm/slub.c:8268)\n   __check_object_size (mm/usercopy.c:197 mm/usercopy.c:258 mm/usercopy.c:223)\n   copy_header_to_ring (fs/fuse/dev_uring.c:618)\n   fuse_uring_prepare_send (fs/fuse/dev_uring.c:776 fs/fuse/dev_uring.c:785)\n   fuse_uring_send_in_task (fs/fuse/dev_uring.c:1306)\n   tctx_task_work_run (io_uring/tw.c:96)\n   task_work_run (kernel/task_work.c:233)\n   io_run_task_work (io_uring/tw.h:84)\n   io_cqring_wait (io_uring/wait.c:278)\n   __do_sys_io_uring_enter (io_uring/io_uring.c:2685)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nBounce both headers through an on-stack copy so the usercopy touches\nstack memory, not the slab object.","modified":"2026-09-13T03:46:51.015069798Z","published":"2026-09-11T19:42:17.576Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80946.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/194d0fb0ea4720535ff3168c9d04c7632cec7071"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a47a416ff68d706dc3327ab583f86b9ee757358b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fd10f40af314f07b6d6e028b1ca25c8b49903aab"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80946.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80946"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"c090c8abae4b6b77a1bee116aa6c385456ebef96"},{"fixed":"194d0fb0ea4720535ff3168c9d04c7632cec7071"},{"fixed":"a47a416ff68d706dc3327ab583f86b9ee757358b"},{"fixed":"fd10f40af314f07b6d6e028b1ca25c8b49903aab"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80946.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.14.0"},{"fixed":"6.18.51"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80946.json"}}],"schema_version":"1.9.0"}