Linux Kernel EUVD-2026-48976

The fuse-uring subsystem integrates FUSE (Filesystem in Userspace) with the Linux io_uring asynchronous I/O interface, first introduced in Linux 6.14. The vulnerability lies in fuse_uring_commit(), which calls copy_from_user() to copy a fuse_out_header struct from user space. Critically, copy_from_user() returns the number of bytes not copied (a positive unsigned residual) rather than a negative errno on partial failure. The code correctly sets req->out.h.error = -EFAULT but stores the positive residual in a ssize_t err variable and jumps to the out: label without correcting it. The downstream function fuse_uring_req_end() then evaluates if (error) and overwrites the correctly-set -EFAULT with this positive residual. FUSE request callers such as fuse_simple_request() test err < 0 to detect failure; a positive value passes this check as apparent success, and the caller proceeds with uninitialized or truncated req->out.args data. The root cause is a signed/unsigned confusion in error propagation - a category of subtle kernel error-handling bugs without a formal CWE assignment in the available data. The CPE string cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the affected product family.