CVE-2026-64264: Linux Kernel fuse-uring EFAULT Handling Flaw

CVE-2026-64264 Overview

CVE-2026-64264 is a Linux kernel vulnerability in the fuse-uring subsystem. The flaw resides in fuse_uring_commit, where a failed copy_from_user() call returns a positive residual value that clobbers an intended -EFAULT error code. Downstream FUSE callers such as fuse_simple_request() test for err < 0 to detect failure, so the positive value is misinterpreted as success. As a result, callers proceed to process uninitialised or partially populated req->out.args data.

Critical Impact
Failure paths in FUSE ring operations return incorrect error semantics, causing consumers to act on uninitialised response buffers and risking undefined behaviour in kernel FUSE clients.

Affected Products

Linux kernel versions containing the fuse-uring subsystem prior to the upstream fix
Stable kernel branches referenced by commits 0483fffdeeb3, 3a0a8bc51a13, and fe604c08d874
Any Linux distribution shipping unpatched kernels with FUSE io_uring support enabled

Discovery Timeline

2026-07-25 - CVE-2026-64264 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64264

Vulnerability Analysis

The vulnerability is an incorrect error handling defect in the Linux kernel FUSE (Filesystem in Userspace) io_uring integration. copy_from_user() returns the number of bytes not copied as an unsigned residual on failure, a value between 1 and sizeof(struct fuse_out_header). In fuse_uring_commit, this positive residual is stored in an ssize_t err variable. The code then assigns req->out.h.error = -EFAULT and jumps to the out: label with err still holding the positive residual.

At the out: label, fuse_uring_req_end(ent, req, err) executes and unconditionally overwrites req->out.h.error with the passed error value when error is truthy. Because the positive residual is truthy, the previously set -EFAULT gets replaced with the positive byte count. Callers testing err < 0 see the positive value as success and continue with uninitialised or partial response arguments.

Root Cause

The root cause is a type and sign mismatch between copy_from_user() return semantics and the kernel convention that negative values indicate error. The defect falls under improper error handling and input validation issues in kernel error path logic.

Attack Vector

Exploitation requires the ability to interact with a FUSE server using the io_uring interface. A malicious or buggy FUSE userspace peer can trigger the failing copy_from_user() path by providing an unmapped or unreadable header buffer. This causes the kernel client to treat a copy failure as success and read from uninitialised memory in req->out.args. See the kernel commit fe604c08d874 for the corrective patch.

The fix assigns err = -EFAULT in the failure branch before jumping to out:, so fuse_uring_req_end() receives a negative errno and correctly sets req->out.h.error to -EFAULT.

Detection Methods for CVE-2026-64264

Indicators of Compromise

Unexpected FUSE client behaviour, including corrupted file contents or metadata returned to userspace after ring commit operations
Kernel log entries or application crashes referencing FUSE operations completing without error but returning inconsistent data
Presence of running kernels lacking the upstream patches 0483fffdeeb3, 3a0a8bc51a13, or fe604c08d874

Detection Strategies

Inventory kernel versions across Linux endpoints and servers and compare against fixed stable branches
Audit whether FUSE with io_uring (CONFIG_FUSE_FS combined with io_uring usage) is enabled and in use by workloads
Monitor FUSE userspace daemons for anomalous copy_from_user failure patterns via kernel tracing tools such as ftrace or bpftrace

Monitoring Recommendations

Enable centralised kernel log collection and alert on FUSE-related warnings or oops signatures
Track kernel package updates through configuration management and vulnerability scanners
Correlate FUSE workload behaviour with kernel build metadata to identify unpatched hosts running FUSE ring operations

How to Mitigate CVE-2026-64264

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 0483fffdeeb3, 3a0a8bc51a13, and fe604c08d874 from the stable tree
Update to distribution kernel packages that include the fuse-uring: fix EFAULT clobber in fuse_uring_commit fix
Reboot affected systems after installing patched kernel packages to activate the corrected code path

Patch Information

The fix is available in the mainline Linux kernel and backported to stable branches. Refer to the following commits: 0483fffdeeb3, 3a0a8bc51a13, and fe604c08d874. The patch assigns err = -EFAULT before the goto out; so that fuse_uring_req_end() receives a negative errno.

Workarounds

Disable FUSE io_uring usage in workloads that can operate with the legacy FUSE transport until patched kernels are deployed
Restrict which local users and containers can run FUSE userspace servers to reduce exposure to the failing code path
Where feasible, unload or avoid loading FUSE modules on systems that do not require FUSE functionality

bash

# Verify running kernel version and confirm patch inclusion
uname -r

# Debian/Ubuntu: install the latest patched kernel
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/[^-]*-[^-]*-//')

# RHEL/CentOS/Fedora: update kernel package
sudo dnf update kernel

# Reboot to activate patched kernel
sudo systemctl reboot