The Linux kernel fuse-uring component had a flaw where copy_from_user() returns a positive residual count on failure, but this value was incorrectly propagated as an error code. Specifically, fuse_uring_commit stored the positive residual in a variable 'err' and set req->out.h.error to -EFAULT, but later fuse_uring_req_end() overwrote this with the positive residual. Since callers check for negative error codes, the positive residual was interpreted as success, leading to use of uninitialized or partial request data. The fix assigns err = -EFAULT before jumping to the cleanup code, ensuring the error is correctly reported.

Because the error code was overwritten with a positive value, failure conditions could be misinterpreted as success by FUSE callers. This may cause them to proceed with uninitialized or incomplete request data, potentially leading to incorrect behavior or data corruption in applications relying on fuse-uring. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific workaround is provided in the available data.