UBUNTU-CVE-2026-80946: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req->in.h out to the ring in fuseuringcopytoring() and req->out.h back in fuseuringcommit(). Both headers live inside the fuserequest slab object, whose cache (fusereqcachep) is created without a usercopy whitelist, so copying them directly to/from userspace trips CONFIGHARDENEDUSERCOPY and panics: usercopy: Kernel memory exposure attempt detected from SLUB object 'fuserequest' (offset 56, size 40)! kernel BUG at mm/usercopy.c:102! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:usercopyabort (mm/usercopy.c:90) Call Trace: checkheapobject (mm/slub.c:8268) checkobjectsize (mm/usercopy.c:197 mm/usercopy.c:258 mm/usercopy.c:223) copyheadertoring (fs/fuse/devuring.c:618) fuseuringpreparesend (fs/fuse/devuring.c:776 fs/fuse/devuring.c:785) fuseuringsendintask (fs/fuse/devuring.c:1306) tctxtaskworkrun (iouring/tw.c:96) taskworkrun (kernel/taskwork.c:233) ioruntaskwork (iouring/tw.h:84) iocqringwait (iouring/wait.c:278) dosysiouringenter (iouring/iouring.c:2685) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:121) Bounce both headers through an on-stack copy so the usercopy touches stack memory, not the slab object.