CVE-2026-80946: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80946 Overview

CVE-2026-80946 is a Linux kernel vulnerability in the FUSE (Filesystem in Userspace) io-uring transport. The fuse-io-uring code path copied request headers directly between the fuse_request slab object and userspace memory. Because the fuse_req_cachep slab cache lacks a usercopy whitelist, CONFIG_HARDENED_USERCOPY detected the transfer as a kernel memory exposure attempt and triggered a kernel panic. The condition affects Linux kernels shipping the FUSE io-uring transport and manifests through the standard io_uring_enter syscall path when FUSE operations are queued.

Critical Impact
Local unprivileged users invoking FUSE over io-uring on hardened kernels can crash the system, resulting in denial of service.

Affected Products

Linux kernel builds containing the FUSE io-uring transport (fs/fuse/dev_uring.c)
Distributions compiled with CONFIG_HARDENED_USERCOPY=y
Systems using FUSE filesystems with io-uring-enabled userspace daemons

Discovery Timeline

2026-09-11 - CVE-2026-80946 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-80946

Vulnerability Analysis

The FUSE io-uring transport transfers request headers between kernel and userspace via the shared ring buffer. Specifically, fuse_uring_copy_to_ring() copies req->in.h outward, and fuse_uring_commit() copies req->out.h back inward. Both header fields reside inside the fuse_request structure allocated from the fuse_req_cachep SLUB cache.

SLUB caches used as sources for userspace copy operations must be created with a usercopy whitelist that specifies the safe offset and size range. The fuse_req_cachep cache was created without such a whitelist. When hardened usercopy validation ran during __check_heap_object(), it detected an attempt to copy 40 bytes starting at offset 56 within a non-whitelisted fuse_request object and called usercopy_abort(), producing a kernel BUG at mm/usercopy.c:102 and halting the CPU with an invalid opcode.

This is a kernel hardening violation classifiable as a denial-of-service condition rather than a memory disclosure primitive, because the copy itself is legitimate; the hardened usercopy check aborts the operation before any data crosses the boundary.

Root Cause

The root cause is missing usercopy whitelist metadata on the fuse_req_cachep slab combined with direct slab-to-userspace copies in the io-uring transport code path. CONFIG_HARDENED_USERCOPY treats any copy from a non-whitelisted cache as a potential kernel memory exposure attempt and terminates the operation with a panic-class BUG.

Attack Vector

An attacker requires local access and the ability to mount or use a FUSE filesystem accessed through io-uring. Issuing FUSE requests via io_uring_enter() reliably triggers the header copy path. On kernels built with hardened usercopy enabled, the resulting usercopy_abort() terminates the offending task and, depending on kernel panic-on-oops settings, can bring down the system. No specialized payload is required; ordinary FUSE traffic through io-uring exercises the affected code.

The upstream fix bounces both headers through an on-stack buffer, ensuring the userspace copy touches stack memory rather than the slab object. See the kernel commit fd10f40af314 and related backport 194d0fb0ea47 and a47a416ff68d for the exact changes.

Detection Methods for CVE-2026-80946

Indicators of Compromise

Kernel log entries containing usercopy: Kernel memory exposure attempt detected from SLUB object 'fuse_request'.
kernel BUG at mm/usercopy.c:102 followed by call traces referencing copy_header_to_ring, fuse_uring_prepare_send, and fuse_uring_send_in_task.
Unexpected process termination for tasks invoking io_uring_enter() against FUSE-backed file descriptors.

Detection Strategies

Ingest dmesg and /var/log/kern.log into your SIEM and alert on usercopy_abort strings paired with fuse_request.
Monitor for repeated Oops: invalid opcode events on hosts running FUSE filesystems.
Correlate crash telemetry with io-uring syscall activity to distinguish this issue from unrelated kernel faults.

Monitoring Recommendations

Track kernel version inventory across Linux hosts to identify systems running unpatched FUSE io-uring code.
Alert on nodes where FUSE daemons repeatedly restart following kernel task termination.
Baseline io-uring usage per workload and flag anomalous invocation from non-privileged users.

How to Mitigate CVE-2026-80946

Immediate Actions Required

Apply the stable kernel updates that include the on-stack header bounce fix referenced in the upstream commits.
Rebuild or update distribution kernels to versions incorporating the FUSE io-uring header copy patches.
Restrict who can mount FUSE filesystems on multi-tenant hosts until the patch is deployed.

Patch Information

The fix is present in the Linux stable tree via commits fd10f40af314, 194d0fb0ea47, and a47a416ff68d. The patches replace the direct slab-to-user copy in fuse_uring_copy_to_ring() and fuse_uring_commit() with copies through an on-stack buffer, avoiding the hardened usercopy violation without weakening the fuse_req_cachep allocation.

Workarounds

Disable FUSE io-uring support in userspace daemons, forcing the legacy /dev/fuse transport path.
Temporarily boot with CONFIG_HARDENED_USERCOPY disabled only on trusted, isolated systems where reduced hardening is acceptable.
Limit user_allow_other and unprivileged FUSE mounts via /etc/fuse.conf to reduce exposure until patching completes.

bash

# Verify running kernel and check for patched commit in changelog
uname -r
zcat /proc/config.gz | grep CONFIG_HARDENED_USERCOPY

# Restrict unprivileged FUSE mounts as an interim control
sudo sed -i 's/^user_allow_other/#user_allow_other/' /etc/fuse.conf