{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "c090c8abae4b6b77a1bee116aa6c385456ebef96"
            },
            {
              "fixed": "194d0fb0ea4720535ff3168c9d04c7632cec7071"
            },
            {
              "fixed": "a47a416ff68d706dc3327ab583f86b9ee757358b"
            },
            {
              "fixed": "fd10f40af314f07b6d6e028b1ca25c8b49903aab"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.14.0"
            },
            {
              "fixed": "6.18.51"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80946.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: copy request headers via a stack buffer for io-uring\n\nThe fuse-io-uring transport copies req-\u003ein.h out to the ring in\nfuse_uring_copy_to_ring() and req-\u003eout.h back in fuse_uring_commit().\nBoth headers live inside the fuse_request slab object, whose cache\n(fuse_req_cachep) is created without a usercopy whitelist, so copying\nthem directly to/from userspace trips CONFIG_HARDENED_USERCOPY and\npanics:\n\n  usercopy: Kernel memory exposure attempt detected from SLUB object\n  'fuse_request' (offset 56, size 40)!\n  kernel BUG at mm/usercopy.c:102!\n  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n  RIP: 0010:usercopy_abort (mm/usercopy.c:90)\n  Call Trace:\n   __check_heap_object (mm/slub.c:8268)\n   __check_object_size (mm/usercopy.c:197 mm/usercopy.c:258 mm/usercopy.c:223)\n   copy_header_to_ring (fs/fuse/dev_uring.c:618)\n   fuse_uring_prepare_send (fs/fuse/dev_uring.c:776 fs/fuse/dev_uring.c:785)\n   fuse_uring_send_in_task (fs/fuse/dev_uring.c:1306)\n   tctx_task_work_run (io_uring/tw.c:96)\n   task_work_run (kernel/task_work.c:233)\n   io_run_task_work (io_uring/tw.h:84)\n   io_cqring_wait (io_uring/wait.c:278)\n   __do_sys_io_uring_enter (io_uring/io_uring.c:2685)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nBounce both headers through an on-stack copy so the usercopy touches\nstack memory, not the slab object.",
  "id": "CVE-2026-80946",
  "modified": "2026-09-13T03:30:52.633517657Z",
  "published": "2026-09-11T19:42:17.576Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/194d0fb0ea4720535ff3168c9d04c7632cec7071"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a47a416ff68d706dc3327ab583f86b9ee757358b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fd10f40af314f07b6d6e028b1ca25c8b49903aab"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80946.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80946"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "fuse: copy request headers via a stack buffer for io-uring"
}