SB20260727316 - Improper Check or Handling of Exceptional Conditions in Linux kernel fuse

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-64264)

CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect handling of a failed request.

The vulnerability exists due to improper error handling in fuse_uring_commit when copying an output header from user memory. A local user can trigger a copy_from_user() failure to cause incorrect handling of a failed request.

The positive residual value can be interpreted as success, causing the caller to proceed with an uninitialised or partially populated req->out.args.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0483fffdeeb363f320e6bf5fc0f0306007507306
• https://git.kernel.org/stable/c/3a0a8bc51a13951c5141262bf770eeea3e0b6228
• https://git.kernel.org/stable/c/fe604c08d874648a69187f6380e5c7858627dc04