---
id: CVE-2026-80946
title: 'fuse: copy request headers via a stack buffer for io-uring'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fuse: copy request headers via a stack buffer for io-uring

  The fuse-io-uring transport copies req->in.h out to the ring in
  fuse_uring_copy_to_ring() and req->out.h bac…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-501
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c090c8abae4b6b77a1bee116aa6c385456ebef96 <
    194d0fb0ea4720535ff3168c9d04c7632cec7071
  - >-
    Linux >= c090c8abae4b6b77a1bee116aa6c385456ebef96 <
    a47a416ff68d706dc3327ab583f86b9ee757358b
  - >-
    Linux >= c090c8abae4b6b77a1bee116aa6c385456ebef96 <
    fd10f40af314f07b6d6e028b1ca25c8b49903aab
  - Linux 6.14
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:45:30.291Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80946'
references:
  - url: 'https://git.kernel.org/stable/c/194d0fb0ea4720535ff3168c9d04c7632cec7071'
  - url: 'https://git.kernel.org/stable/c/a47a416ff68d706dc3327ab583f86b9ee757358b'
  - url: 'https://git.kernel.org/stable/c/fd10f40af314f07b6d6e028b1ca25c8b49903aab'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80946.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80946'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532123'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80946'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80946'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80946.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00166
epssPercentile: 0.05797
ingestedAt: '2026-09-14T00:35:28.532Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fuse: copy request headers via a stack buffer for io-uring

The fuse-io-uring transport copies req->in.h out to the ring in
fuse_uring_copy_to_ring() and req->out.h back in fuse_uring_commit().
Both headers live inside the fuse_request slab object, whose cache
(fuse_req_cachep) is created without a usercopy whitelist, so copying
them directly to/from userspace trips CONFIG_HARDENED_USERCOPY and
panics:

  usercopy: Kernel memory exposure attempt detected from SLUB object
  'fuse_request' (offset 56, size 40)!
  kernel BUG at mm/usercopy.c:102!
  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:usercopy_abort (mm/usercopy.c:90)
  Call Trace:
   __check_heap_object (mm/slub.c:8268)
   __check_object_size (mm/usercopy.c:197 mm/usercopy.c:258 mm/usercopy.c:223)
   copy_header_to_ring (fs/fuse/dev_uring.c:618)
   fuse_uring_prepare_send (fs/fuse/dev_uring.c:776 fs/fuse/dev_uring.c:785)
   fuse_uring_send_in_task (fs/fuse/dev_uring.c:1306)
   tctx_task_work_run (io_uring/tw.c:96)
   task_work_run (kernel/task_work.c:233)
   io_run_task_work (io_uring/tw.h:84)
   io_cqring_wait (io_uring/wait.c:278)
   __do_sys_io_uring_enter (io_uring/io_uring.c:2685)
   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

Bounce both headers through an on-stack copy so the usercopy touches
stack memory, not the slab object.

## Affected

- `Linux >= c090c8abae4b6b77a1bee116aa6c385456ebef96 < 194d0fb0ea4720535ff3168c9d04c7632cec7071`
- `Linux >= c090c8abae4b6b77a1bee116aa6c385456ebef96 < a47a416ff68d706dc3327ab583f86b9ee757358b`
- `Linux >= c090c8abae4b6b77a1bee116aa6c385456ebef96 < fd10f40af314f07b6d6e028b1ca25c8b49903aab`
- `Linux 6.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80946.json)