CVE-2026-80946: fuse: copy request headers via a stack buffer for io-uring

CVE-2026-80946: fuse: copy request headers via a stack buffer for io-uring

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

fuse: copy request headers via a stack buffer for io-uring

The fuse-io-uring transport copies req->in.h out to the ring in
fuse_uring_copy_to_ring() and req->out.h back in fuse_uring_commit().
Both headers live inside the fuse_request slab object, whose cache
(fuse_req_cachep) is created without a usercopy whitelist, so copying
them directly to/from userspace trips CONFIG_HARDENED_USERCOPY and
panics:

  usercopy: Kernel memory exposure attempt detected from SLUB object
  'fuse_request' (offset 56, size 40)!
  kernel BUG at mm/usercopy.c:102!
  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:usercopy_abort (mm/usercopy.c:90)
  Call Trace:
   __check_heap_object (mm/slub.c:8268)
   __check_object_size (mm/usercopy.c:197 mm/usercopy.c:258 mm/usercopy.c:223)
   copy_header_to_ring (fs/fuse/dev_uring.c:618)
   fuse_uring_prepare_send (fs/fuse/dev_uring.c:776 fs/fuse/dev_uring.c:785)
   fuse_uring_send_in_task (fs/fuse/dev_uring.c:1306)
   tctx_task_work_run (io_uring/tw.c:96)
   task_work_run (kernel/task_work.c:233)
   io_run_task_work (io_uring/tw.h:84)
   io_cqring_wait (io_uring/wait.c:278)
   __do_sys_io_uring_enter (io_uring/io_uring.c:2685)
   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

Bounce both headers through an on-stack copy so the usercopy touches
stack memory, not the slab object.

The Linux kernel CVE team has assigned CVE-2026-80946 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.14 with commit c090c8abae4b6b77a1bee116aa6c385456ebef96 and fixed in 6.18.51 with commit 194d0fb0ea4720535ff3168c9d04c7632cec7071
	Issue introduced in 6.14 with commit c090c8abae4b6b77a1bee116aa6c385456ebef96 and fixed in 7.2.4 with commit a47a416ff68d706dc3327ab583f86b9ee757358b
	Issue introduced in 6.14 with commit c090c8abae4b6b77a1bee116aa6c385456ebef96 and fixed in 7.3-rc1 with commit fd10f40af314f07b6d6e028b1ca25c8b49903aab

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-80946
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/fuse/dev_uring.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/194d0fb0ea4720535ff3168c9d04c7632cec7071
	https://git.kernel.org/stable/c/a47a416ff68d706dc3327ab583f86b9ee757358b
	https://git.kernel.org/stable/c/fd10f40af314f07b6d6e028b1ca25c8b49903aab