Към съдържанието
Търсене

CVE-2026-64264: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber in fuse_uring_commit copy_from_user() returns the number of bytes not copied as an unsigned residual on failure (1..sizeof(struct fuse_out_header)). fuse_uring_commit stores that residual in ssize_t err, sets req->out.h.error to -EFAULT, then jumps to out: with err still holding the positive residual. err = copy_from_user(&req->out.h, &ent->headers->in_out, sizeof(req->out.h)); if (err) { req->out.h.error = -EFAULT; goto out; /* err is the positive residual */ } ... out: fuse_uring_req_end(ent, req, err); fuse_uring_req_end() then runs if (error) req->out.h.error = error; which overwrites the just-assigned -EFAULT with the positive residual. FUSE callers such as fuse_simple_request() test err < 0 to detect failure, so the positive value is interpreted as success and the caller proceeds with an uninitialised or partial req->out.args. Fix by assigning err = -EFAULT in the failure branch before jumping to out, so fuse_uring_req_end() receives a negative errno and sets req->out.h.error to -EFAULT.

    Засегнати продукти

    • Linux Linux: c090c8abae4b6b77a1bee116aa6c385456ebef96 преди 0483fffdeeb363f320e6bf5fc0f0306007507306; c090c8abae4b6b77a1bee116aa6c385456ebef96 преди fe604c08d874648a69187f6380e5c7858627dc04; c090c8abae4b6b77a1bee116aa6c385456ebef96 преди 3a0a8bc51a13951c5141262bf770eeea3e0b6228
    • Linux Linux: 6.14; преди 6.14; 6.18.39 до 6.18.*; 7.1.4 до 7.1.*; 7.2 до *

    История

    • 25 юли 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-64264: Linux | freedomonline.bg