PT-2026-26679 · Libfuse · Libfuse

Published 2026-03-20 · Updated 2026-03-20 · CVE-2026-33179

NVD

CVSS v3.1

5.5

Medium

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a NULL pointer dereference and memory leak in fuse uring init queue allows a local user to crash the FUSE daemon or cause resource exhaustion. When numa alloc local fails during io uring queue entry setup, the code proceeds with NULL pointers. When fuse uring register queue fails, NUMA allocations are leaked and the function incorrectly returns success. Only the io uring transport is affected; the traditional /dev/fuse path is not affected. PoC confirmed with AddressSanitizer/LeakSanitizer. This issue has been patched in version 3.18.2.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-33179

Affected Products

Libfuse

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-33179 · Security Note
• https://github.com/libfuse/libfuse/commit/7beb86c09b6ec5aab14dc25256ed8a5ad18554d7 · Note
• https://github.com/libfuse/libfuse/security/advisories/GHSA-x669-v3mq-r358 · Note
• https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2 · Note