Executive brief
A vulnerability in the Linux kernel's FUSE (Filesystem in Userspace) subsystem using io_uring could allow a system to incorrectly treat a failed data copy operation as a success. This could lead to the kernel processing uninitialized or partial data, potentially causing unpredictable system behavior or stability issues. The issue is caused by a programming error where an error code was overwritten by a positive value, masking the failure.
Technical details
A logic error in 'fuse_uring_commit' within 'fs/fuse/dev_uring.c' causes the kernel to misinterpret failed 'copy_from_user' operations. When 'copy_from_user' fails, it returns a positive residual value representing the number of bytes not copied. The code was storing this positive residual in an error variable that was subsequently used by 'fuse_uring_req_end'. Because FUSE callers typically check for 'err < 0' to detect failure, the positive residual was interpreted as a successful operation, causing the caller to proceed with uninitialized or partial request arguments. This has been fixed by ensuring the error variable is explicitly set to '-EFAULT' upon failure.
Affected products
- Linux Linux Kernel 6.14 to 6.18.39, 7.1.4
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory