CVE-2026-33179 Details
Description
libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a NULL pointer dereference and memory leak in fuse_uring_init_queue allows a local user to crash the FUSE daemon or cause resource exhaustion. When numa_alloc_local fails during io_uring queue entry setup, the code proceeds with NULL pointers. When fuse_uring_register_queue fails, NUMA allocations are leaked and the function incorrectly returns success. Only the io_uring transport is affected; the traditional /dev/fuse path is not affected. PoC confirmed with AddressSanitizer/LeakSanitizer. This issue has been patched in version 3.18.2.
A vulnerability in libfuse, specifically in versions 3.18.0 prior to 3.18.2, has been identified. This issue involves a NULL pointer dereference and a memory leak in the function 'fuse_uring_init_queue', which is part of the io_uring transport. The vulnerability allows a local user to crash the FUSE daemon or cause resource exhaustion. The problem arises because the function 'numa_alloc_local' is called to allocate memory for request headers and payloads without checking if the allocation was successful. If the allocation fails, the code continues to execute with NULL pointers, leading to a crash when the io_uring queue is used. Additionally, when 'fuse_uring_register_queue' fails, the function incorrectly reports a success, causing leaked memory from the failed NUMA allocations. This vulnerability has been confirmed with a proof of concept that utilizes AddressSanitizer and LeakSanitizer.
Users can upgrade to libfuse version 3.18.2 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libfuse project libfuse | >= 3.18.0, < 3.18.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 27, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |