CVE-2026-64264: fuse-uring: fix EFAULT clobber in fuse_uring_commit
In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: fix EFAULT clobber in fuseuringcommit
copyfromuser() returns the number of bytes not copied as an unsigned residual on failure (1..sizeof(struct fuseoutheader)). fuseuringcommit stores that residual in ssizet err, sets req->out.h.error to -EFAULT, then jumps to out: with err still holding the positive residual.
err = copyfromuser(&req->out.h, &ent->headers->inout, sizeof(req->out.h)); if (err) { req->out.h.error = -EFAULT; goto out; / err is the positive residual / } ... out: fuseuringreqend(ent, req, err);
fuseuringreqend() then runs
if (error) req->out.h.error = error;
which overwrites the just-assigned -EFAULT with the positive residual. FUSE callers such as fusesimplerequest() test err < 0 to detect failure, so the positive value is interpreted as success and the caller proceeds with an uninitialised or partial req->out.args.
Fix by assigning err = -EFAULT in the failure branch before jumping to out, so fuseuringreqend() receives a negative errno and sets req->out.h.error to -EFAULT.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
An attacker needs local access and low privileges, as reflected by the CVSS vector. Exploitation involves causing copy_from_user() to fail while fuse_uring_commit() copies the FUSE output header.
What is the impact if the failure occurs?
The copy failure can be reported as a positive residual byte count rather than a negative error. FUSE callers may interpret this as success and continue using uninitialised or partially populated req->out.args, resulting in a denial of service.
How can I determine whether a kernel includes the fix?
Check whether the kernel source contains the change that assigns err = -EFAULT in the copy_from_user() failure branch of fuse_uring_commit() before control reaches the out path. The provided stable-tree references identify commits containing the fix.