CVE-2026-80946

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1

Description An issue exists in the fuse-io-uring transport where request headers are copied directly to and from userspace. Specifically, the fuse uring copy to ring() function copies req->in.h and the fuse uring commit() function copies req->out.h. Because these headers reside within the fuse request slab object, and the associated cache fuse req cachep lacks a usercopy whitelist, this action triggers CONFIG HARDENED USERCOPY, leading to a kernel panic. This occurs during the execution of the copy header to ring() function.

Recommendations Update the Linux kernel to version 7.2.6-1.1 or later.