PT-2026-64485 · Linux · Linux
CVE-2026-64264
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
fuse-uring: fix EFAULT clobber in fuse uring commit
copy from user() returns the number of bytes not copied as an unsigned
residual on failure (1..sizeof(struct fuse out header)). fuse uring commit
stores that residual in ssize t err, sets req->out.h.error to -EFAULT,
then jumps to out: with err still holding the positive residual.
err = copy from user(&req->out.h, &ent->headers->in out,
sizeof(req->out.h));
if (err) {
req->out.h.error = -EFAULT;
goto out; /* err is the positive residual */
}
...
out:
fuse uring req end(ent, req, err);
fuse uring req end() then runs
if (error)
req->out.h.error = error;
which overwrites the just-assigned -EFAULT with the positive residual.
FUSE callers such as fuse simple request() test err < 0 to detect
failure, so the positive value is interpreted as success and the
caller proceeds with an uninitialised or partial req->out.args.
Fix by assigning err = -EFAULT in the failure branch before jumping
to out, so fuse uring req end() receives a negative errno and sets
req->out.h.error to -EFAULT.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux