PT-2026-26675 · Libfuse · Libfuse

Agabhin · Published 2026-03-19 · Updated 2026-03-30 · CVE-2026-33150

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libfuse versions 3.18.0 through 3.18.1

Description libfuse, the reference implementation of the Linux FUSE, contains a flaw in its io uring subsystem. A use-after-free condition exists from versions 3.18.0 up to, but not including, 3.18.2. This occurs when the creation of an io uring thread fails due to resource limitations, such as those imposed by cgroup pids.max. Specifically, the fuse uring start() function frees the ring pool structure but retains a pointer to it within the session state. This dangling pointer is then dereferenced during session shutdown, resulting in a use-after-free. The issue is reliably triggered in containerized environments where cgroup pids.max limits thread creation.

Recommendations Update to libfuse version 3.18.2 or later.

Exploit

Fix

RCE

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2026-05825

CVE-2026-33150

GHSA-QXV7-XRC2-QMFX

Affected Products

Libfuse

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33150.json · Exploit
• https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx · Vendor Advisory
• https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33150 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33150 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-33150 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05825 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33150 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33150 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33150 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33150 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33150 · Security Note
• https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2 · Note
• https://twitter.com/CVEnew/status/2035262155868569757 · Twitter Post
• https://twitter.com/oss_security/status/2035184297850679649 · Twitter Post