CVE-2026-64264

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fuse-uring: fix EFAULT clobber in fuse_uring_commit<br /> <br /> copy_from_user() returns the number of bytes not copied as an unsigned<br /> residual on failure (1..sizeof(struct fuse_out_header)). fuse_uring_commit<br /> stores that residual in ssize_t err, sets req-&gt;out.h.error to -EFAULT,<br /> then jumps to out: with err still holding the positive residual.<br /> <br /> err = copy_from_user(&amp;req-&gt;out.h, &amp;ent-&gt;headers-&gt;in_out,<br /> sizeof(req-&gt;out.h));<br /> if (err) {<br /> req-&gt;out.h.error = -EFAULT;<br /> goto out; /* err is the positive residual */<br /> }<br /> ...<br /> out:<br /> fuse_uring_req_end(ent, req, err);<br /> <br /> fuse_uring_req_end() then runs<br /> <br /> if (error)<br /> req-&gt;out.h.error = error;<br /> <br /> which overwrites the just-assigned -EFAULT with the positive residual.<br /> FUSE callers such as fuse_simple_request() test err out.args.<br /> <br /> Fix by assigning err = -EFAULT in the failure branch before jumping<br /> to out, so fuse_uring_req_end() receives a negative errno and sets<br /> req-&gt;out.h.error to -EFAULT.