PT-2026-64485 · Linux · Linux
CVE-2026-64264
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: fix EFAULT clobber in fuse uring commit
copy from user() returns the number of bytes not copied as an unsigned
residual on failure (1..sizeof(struct fuse out header)). fuse uring commit
stores that residual in ssize t err, sets req->out.h.error to -EFAULT,
then jumps to out: with err still holding the positive residual.
err = copy from user(&req->out.h, &ent->headers->in out,
sizeof(req->out.h));
if (err) {
req->out.h.error = -EFAULT;
goto out; /* err is the positive residual */
}
...
out:
fuse uring req end(ent, req, err);
fuse uring req end() then runs
if (error)
req->out.h.error = error;
which overwrites the just-assigned -EFAULT with the positive residual.
FUSE callers such as fuse simple request() test err < 0 to detect
failure, so the positive value is interpreted as success and the
caller proceeds with an uninitialised or partial req->out.args.
Fix by assigning err = -EFAULT in the failure branch before jumping
to out, so fuse uring req end() receives a negative errno and sets
req->out.h.error to -EFAULT.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux