CVE-2026-33150
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In libfuse versions 3.18.0 through 3.18.1 before 3.18.2, a use-after-free vulnerability exists in the io_uring subsystem. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores a dangling pointer in the session state, leading to a use-after-free during session shutdown.
Risk Assessment
A local attacker can crash FUSE filesystem processes and potentially execute arbitrary code. The vulnerability is especially critical in containerized environments where cgroup pids.max limits naturally constrain thread creation.
Recommendation
Immediately upgrade libfuse to version 3.18.2 or later. In container environments, consider reviewing and increasing the cgroup pids.max limit for FUSE processes.
Other vulnerabilities in libfuse
Original NVD description (English source)
libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2.