Executive brief
The FUSE filesystem's io-uring transport was copying request headers directly from/to kernel slab memory in a way that triggered security protections against unauthorized kernel memory access to userspace. This caused the kernel to panic when CONFIG_HARDENED_USERCOPY was enabled. The fix bounces headers through stack-allocated buffers to satisfy memory safety checks.
Technical details
The vulnerability is a CONFIG_HARDENED_USERCOPY detection in the FUSE io-uring transport layer. The fuse_uring_copy_to_ring() and fuse_uring_commit() functions were directly copying req->in.h and req->out.h headers (from the fuse_request slab object without a usercopy whitelist) to/from userspace via the io-uring ring, triggering usercopy_abort() and kernel panic. The root cause is that the slab cache (fuse_req_cachep) was not configured to permit user copying of those header regions. The fix introduces stack-local copies (in_header, out_header) so that copy_to/from_user operations touch stack memory rather than the slab object, bypassing the hardened usercopy check. No authentication bypass or privilege escalation; this is a denial-of-service condition on systems with CONFIG_HARDENED_USERCOPY enabled.
Affected products
- Linux Linux kernel 5.19 and later (introduced by commit c090c8abae4b)
Timeline
- 2026-09-11: disclosed
- 2026-08-31: patched