{"id":21279,"date":"2026-09-12T04:30:58","date_gmt":"2026-09-11T20:30:58","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80946"},"modified":"2026-09-12T04:30:58","modified_gmt":"2026-09-11T20:30:58","slug":"cve-2026-80946","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80946","title":{"rendered":"CVE-2026-80946 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: copy request he"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>fuse: copy request headers via a stack buffer for io-uring<\/p>\n<p>The fuse-io-uring transport copies req-&gt;in.h out to the ring in<br \/>\nfuse_uring_copy_to_ring() and req-&gt;out.h back in fuse_uring_commit().<br \/>\nBoth headers live inside the fuse_request slab object, whose cache<br \/>\n(fuse_req_cachep) is created without a usercopy whitelist, so copying<br \/>\nthem directly to\/from userspace trips CONFIG_HARDENED_USERCOPY and<br \/>\npanics:<\/p>\n<p>  usercopy: Kernel memory exposure attempt detected from SLUB object<br \/>\n  &#8216;fuse_request&#8217; (offset 56, size 40)!<br \/>\n  kernel BUG at mm\/usercopy.c:102!<br \/>\n  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI<br \/>\n  RIP: 0010:usercopy_abort (mm\/usercopy.c:90)<br \/>\n  Call Trace:<br \/>\n   __check_heap_object (mm\/slub.c:8268)<br \/>\n   __check_object_size (mm\/usercopy.c:197 mm\/usercopy.c:258 mm\/usercopy.c:223)<br \/>\n   copy_header_to_ring (fs\/fuse\/dev_uring.c:618)<br \/>\n   fuse_uring_prepare_send (fs\/fuse\/dev_uring.c:776 fs\/fuse\/dev_uring.c:785)<br \/>\n   fuse_uring_send_in_task (fs\/fuse\/dev_uring.c:1306)<br \/>\n   tctx_task_work_run (io_uring\/tw.c:96)<br \/>\n   task_work_run (kernel\/task_work.c:233)<br \/>\n   io_run_task_work (io_uring\/tw.h:84)<br \/>\n   io_cqring_wait (io_uring\/wait.c:278)<br \/>\n   __do_sys_io_uring_enter (io_uring\/io_uring.c:2685)<br \/>\n   entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:121)<\/p>\n<p>Bounce both headers through an on-stack copy so the usercopy touches<br \/>\nstack memory, not the slab object.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>fuse: copy request headers via a stack buffer for io-uring<\/p>\n<p>The fuse-io-uring transport copies req-&gt;in.h out to the ring in<br \/>\nfuse_ur<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21279","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21279","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21279"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21279"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21279"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}