CVE-2026-33179
MediumSummary
A vulnerability in libfuse versions 3.18.0 through 3.18.1 causes a NULL pointer dereference and memory leak in the fuse_uring_init_queue function. A local user can exploit this to crash the FUSE daemon or exhaust system resources.
Risk Assessment
The risk is a potential DoS attack by a local user, which can disrupt FUSE-based filesystems and lead to service unavailability.
Recommendation
Immediately upgrade libfuse to version 3.18.2 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a NULL pointer dereference and memory leak in fuse_uring_init_queue allows a local user to crash the FUSE daemon or cause resource exhaustion. When numa_alloc_local fails during io_uring queue en