CVE-2026-80946 Linux CVE debrief

Who should care

Linux kernel administrators and security teams should assess exposure and apply patches to prevent potential kernel memory exposure and system crashes. They should review system logs for potential exploitation attempts and update the Linux kernel to the latest version. Additionally, they should verify system configurations for CONFIG_HARDENED_USERCOPY and monitor for unusual system activity.

Why it matters

Linux kernel administrators and security teams should assess exposure and apply patches to prevent potential kernel memory exposure and system crashes.

• Potential kernel memory exposure
• System crash due to CONFIG_HARDENED_USERCOPY panic
• Need for patching to prevent exploitation

Technical summary

The fuse-io-uring transport copies req->in.h out to the ring in fuse_uring_copy_to_ring() and req->out.h back in fuse_uring_commit(). Both headers live inside the fuse_request slab object, whose cache (fuse_req_cachep) is created without a usercopy whitelist, so copying them directly to/from userspace trips CONFIG_HARDENED_USERCOPY and panics. The fix involves bouncing both headers through an on-stack copy so the usercopy touches stack memory, not the slab object. This change prevents the kernel memory exposure attempt detected from SLUB object 'fuse_request'.

Defensive priority

Linux kernel administrators and security teams should assess exposure and apply patches.

Recommended defensive actions

• Assess Linux kernel exposure and apply patches
• Review system logs for potential exploitation attempts
• Update Linux kernel to the latest version
• Verify system configurations for CONFIG_HARDENED_USERCOPY
• Monitor for unusual system activity
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability was resolved by bouncing both headers through an on-stack copy so the usercopy touches stack memory, not the slab object. This change prevents the kernel memory exposure attempt detected from SLUB object 'fuse_request'. The fix involves modifying the fuse-io-uring transport to use a stack buffer for copying request headers, thus avoiding the CONFIG_HARDENED_USERCOPY panic.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.