CVE-2026-80946

In the Linux kernel, the following vulnerability has been resolved:

fuse: copy request headers via a stack buffer for io-uring

The fuse-io-uring transport copies req->in.h out to the ring in fuse uring copy to ring() and req->out.h back in fuse uring commit(). Both headers live inside the fuse request slab object, whose cache (fuse req cachep) is created without a usercopy whitelist, so copying them directly to/from userspace trips CONFIG HARDENED USERCOPY and panics:

usercopy: Kernel memory exposure attempt detected from SLUB object 'fuse request' (offset 56, size 40)! kernel BUG at mm/usercopy.c:102! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:usercopy abort (mm/usercopy.c:90) Call Trace: check heap object (mm/slub.c:8268) check object size (mm/usercopy.c:197 mm/usercopy.c:258 mm/usercopy.c:223) copy header to ring (fs/fuse/dev uring.c:618) fuse uring prepare send (fs/fuse/dev uring.c:776 fs/fuse/dev uring.c:785) fuse uring send in task (fs/fuse/dev uring.c:1306) tctx task work run (io uring/tw.c:96) task work run (kernel/task work.c:233) io run task work (io uring/tw.h:84) io cqring wait (io uring/wait.c:278) do sys io uring enter (io uring/io uring.c:2685) entry SYSCALL 64 after hwframe (arch/x86/entry/entry 64.S:121)

Bounce both headers through an on-stack copy so the usercopy touches stack memory, not the slab object.