CVE-2026-80946

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

DEBIAN-CVE-2026-80946

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

UBUNTU-CVE-2026-80946

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

EUVD-2026-76269

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

CVE-2026-80946 fuse: copy request headers via a stack buffer for io-uring

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

CVE-2026-80946

This Linux kernel vulnerability affects the FUSE-io-uring transport. The fuse_request slab cache (fuse_req_cachep) is created without a usercopy whitelist , so directly copying req->in.h to the ring or req->out.h back from the ring trips CONFIG_HARDENED_USERCOPY , triggering a kernel panic ...

CVE-2026-80946 fuse: copy request headers via a stack buffer for io-uring

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

CVE-2026-80946

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

CVE-2026-80946: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuseuringcopytoring and req-out.h back in fuseuringcommit. Both headers live inside the fuserequest slab...

CVE-2026-89560: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCKACCESSFSMAKEREG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this name does not exist in the unified view, even if it is present in on...

PT-2026-90076

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the fuse-io-uring transport where request headers are copied directly to and from userspace. Specifically, the fuse uring copy to ring function copies req-in.h and the fus...

openSUSE 16 Security Update : fuse-overlayfs (openSUSE-SU-2026:21753-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21753-1 advisory. This update for fuse-overlayfs fixes the following issue: - CVE-2026-52791: privilege escalation due to SUID/SGID bit preservation after truncate...

kernel: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req

A flaw was found in the Linux kernel's fuse component. When a fuse request is interrupted and then resent, a specific interrupt entry intrentry is not properly cleared. If the requesting task subsequently receives a fatal signal, this uncleared entry can lead to a use-after-free condition. This...

Security update for fuse-overlayfs (moderate)

openSUSE security update: security update for fuse-overlayfs ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21753-1 Rating: moderate References: bsc1273100 Cross-References: CVE-2026-52791 CVSS scores: CVE-2026-52791 SUSE : 4.7...

Security update for fuse-overlayfs

This update for fuse-overlayfs fixes the following issue: CVE-2026-52791: Privilege Escalation Vulnerability via SUID/SGID Bit Preservation bsc1273100. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:4026-1 Security update for fuse-overlayfs

This update for fuse-overlayfs fixes the following issue: - CVE-2026-52791: Privilege Escalation Vulnerability via SUID/SGID Bit Preservation bsc1273100...

SUSE CVE-2026-80855

In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak on open OTRUNC DAX failure fuseopen takes filemapinvalidatelock for a DAX truncate daxtruncate = true and releases it before the outinodeunlock label. But when fusedaxbreaklayouts fails, the goto...

SUSE CVE-2026-80856

In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak on setattr writeback failure fusedosetattr takes filemapinvalidatelock for a DAX truncate faultblocked = true and releases it at the out:/error: labels. But when a writeback flush is also needed, a...

SUSE CVE-2026-80857

In the Linux kernel, the following vulnerability has been resolved: fuse: wait for FRFINISHED on abortonkill to prevent use-after-free The abortonkill path in requestwaitanswer calls fuseabortconn and returns without waiting for FRFINISHED. If fusedevdowrite is concurrently processing the same...

SUSE CVE-2026-80858

In the Linux kernel, the following vulnerability has been resolved: fuse: publish io-uring queues with release semantics fuseuringcreatequeue initializes a fuseringqueue and then publishes the pointer into ring-queuesqid with WRITEONCE under the fch-lock. There are several readers that may...