CVE-2026-64264

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the fuse-uring component where the fuse uring commit() function incorrectly handles failures during memory copying. When copy from user() fails, it returns a positive unsigned residual value representing the number of bytes not copied. The fuse uring commit() function stores this positive value in the err variable and attempts to set the error status to -EFAULT. However, the subsequent call to fuse uring req end() overwrites the -EFAULT status with the positive residual value. Because FUSE callers, such as fuse simple request(), interpret any non-negative value as success, the system may proceed using uninitialized or partial data in req->out.args.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.