The Linux kernel fuse io-uring transport copied request headers directly from the fuse_request slab object to userspace, which violated CONFIG_HARDENED_USERCOPY protections and caused kernel panics due to kernel memory exposure detection. Specifically, the headers req->in.h and req->out.h were copied without a usercopy whitelist, triggering a kernel BUG and invalid opcode exception. The vulnerability was addressed by modifying the code to copy these headers through an on-stack buffer, ensuring usercopy operations touch stack memory rather than the slab object.

This vulnerability causes kernel panics and system instability when the fuse io-uring transport copies request headers, due to hardened usercopy protections detecting unauthorized kernel memory exposure attempts. While no active exploits are known, affected systems may experience denial of service via kernel crashes.

A fix has been implemented in the Linux kernel to address this issue by changing the copying method of request headers to use an on-stack buffer. Users should update to the patched kernel version once available. Patch status is not yet confirmed in the provided data; check the official Linux kernel advisories for the exact fixed versions and remediation guidance.