PT-2026-26675 · Libfuse · Libfuse

Agabhin · Publicado 2026-03-19 · Atualizado 2026-03-30 · CVE-2026-33150

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libfuse versions 3.18.0 through 3.18.1

Description libfuse, the reference implementation of the Linux FUSE, contains a flaw in its io uring subsystem. A use-after-free condition exists from versions 3.18.0 up to, but not including, 3.18.2. This occurs when the creation of an io uring thread fails due to resource limitations, such as those imposed by cgroup pids.max. Specifically, the fuse uring start() function frees the ring pool structure but retains a pointer to it within the session state. This dangling pointer is then dereferenced during session shutdown, resulting in a use-after-free. The issue is reliably triggered in containerized environments where cgroup pids.max limits thread creation.

Recommendations Update to libfuse version 3.18.2 or later.

Exploit

Correção

RCE

DoS

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

BDU:2026-05825

CVE-2026-33150

GHSA-QXV7-XRC2-QMFX

Produtos afetados

Libfuse

Referências · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33150.json · Exploit
• https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx · Aviso do Fabricante
• https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2 · Nota
• https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836 · Correção
• https://twitter.com/CVEnew/status/2035262155868569757 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33150 · Aviso do Fabricante
• https://twitter.com/oss_security/status/2035184297850679649 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33150 · Nota de Segurança
• https://osv.dev/vulnerability/BELL-CVE-2026-33150 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2026-05825 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33150 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-33150 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-33150 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33150 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-33150 · Nota de Segurança