Linux fuse io-uring: request headers copied from a non-whitelisted slab object panics hardened usercopy

Impact

The fuse-io-uring transport copies req->in.h and req->out.h directly between userspace and the fuse_request slab object, whose cache has no usercopy whitelist. On kernels built with CONFIG_HARDENED_USERCOPY the check fires and the kernel BUGs, taking the node down. Any unprivileged user who can mount or talk to a FUSE filesystem over the io-uring transport can reach it, which matters on GPU nodes that run FUSE-backed object storage or dataset mounts inside tenant pods - a single tenant can panic a host that is expensive to drain and reboot. Without hardened usercopy the same copies read and write slab memory outside a declared whitelist.

Who can reach it

Local user able to drive a FUSE filesystem over the io-uring transport - in practice any tenant workload with a FUSE mount (dataset cache, object-store gateway) in its container. No special privilege beyond access to the FUSE device or mount is described.

What to do

Apply the stable kernel update carrying the bounce-buffer fix and reboot each node; the fix is in fs/fuse, so a reboot is required. Until then, disabling the fuse io-uring transport (or not exposing FUSE mounts to untrusted tenants) removes the path without a reboot.

References

Related entries

• Linux net/smc: connection freed before tasklet drain leaves a use-after-free on the SMC-D receive pathCVE-2026-80979 · Linux kernel net/smc (SMC-D connection teardown vs. rx tasklet)Unscored
• Linux kernel net/smc: oversized SMC-Rv2 LLC messages let a peer delete or install RDMA rkeysCVE-2026-80985 · Linux kernel net/smc (SMC-Rv2 LLC rkey handling)Unscored
• Linux kernel net/smc: out-of-bounds read parsing the v2 extension on every SMC-Rv2 link additionCVE-2026-80986 · Linux kernel net/smc (SMC-Rv2 add-link v2 extension parsing)Unscored
• Linux kernel io_uring/query: unclamped user size lets a local task request ~4 GiB of clear_user zeroingCVE-2026-81009 · Linux kernel io_uring (IORING_REGISTER_QUERY, copy_struct_to_user size cap)Unscored
• Linux kernel io_uring/waitid: canceled task work runs __do_wait() in the wrong task contextCVE-2026-81010 · Linux kernel io_uring waitid (task_work cancellation handling)Unscored
• Linux kernel Intel Speed Select: unvalidated ioctl indices reach MMIO offsets and NULL instancesCVE-2026-89438 · Linux kernel Intel SST driver (isst_if_common ioctl input validation)Unscored