Loading story…
libfuse has fixed two memory-safety vulnerabilities in its io_uring transport path, both introduced in version 3.18.0 and remediated in 3.18.2. The flaws, tracked as CVE-2026-33150 and CVE-2026-33179, affect only the io_uring code path; the traditional /dev/fuse transport is not impacted. CVE-2026-33150 is a high-severity use-after-free that can allow a local user to crash a FUSE daemon and may enable arbitrary code execution, while CVE-2026-33179 is a moderate-severity bug involving a NULL pointer dereference and memory leak that can crash the daemon during allocation failure and leak NUMA memory.
Follow-up disclosure said the use-after-free can be triggered when pthread_create fails or when io_uring_queue_init_params fails, and noted that container resource limits such as cgroup pids.max and RLIMIT_NPROC can reliably force the pthread_create failure condition. The same writeup said CVE-2026-33179 actually comprises two separate sub-bugs: a NULL dereference on numa_alloc_local failure and an error-handling flaw that can leave the filesystem hung, but that these issues do not chain into the use-after-free in shipped code. The vulnerabilities were privately reported by Abhinav Agarwal, reviewed for remediation by Akshat Sinha, and addressed through a coordinated libfuse release followed by GitHub Security Advisories.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
A subsequent technical clarification explained that CVE-2026-33150 can be triggered by pthread_create failure or io_uring_queue_init_params failure, and that container limits such as cgroup pids.max and RLIMIT_NPROC can reliably induce the pthread_create failure. It also clarified that CVE-2026-33179 comprises two separate sub-bugs and does not chain into the use-after-free in shipped code.
GitHub Security Advisories for CVE-2026-33150 and CVE-2026-33179 were published after the coordinated release. A follow-up writeup dated the advisory publication to March 19, 2026.
An oss-sec post publicly disclosed CVE-2026-33150 and CVE-2026-33179, stating they affected libfuse's io_uring code path and were fixed in 3.18.2. The disclosure noted that local users could trigger daemon crashes and, for the use-after-free, potentially arbitrary code execution.
The libfuse project remediated both vulnerabilities in version 3.18.2 through a coordinated release. The fixes addressed a high-severity use-after-free that could crash a FUSE daemon or potentially enable code execution, and a moderate-severity NULL dereference/memory leak issue that could crash the daemon or hang the filesystem under certain failure conditions.
Abhinav Agarwal privately disclosed the two io_uring-related memory-safety issues to the libfuse maintainer, beginning a coordinated remediation process. Akshat Sinha later reviewed the fixes.
Two vulnerabilities affecting libfuse's io_uring transport path were introduced in version 3.18.0: CVE-2026-33150, a use-after-free, and CVE-2026-33179, involving a NULL dereference and memory leak/error-handling issues. The traditional /dev/fuse transport was not affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A flaw in the Linux kernel FUSE subsystem, tracked as **`CVE-2026-31694`**, allows a local attacker to escalate privileges to root by exploiting how cached directory entries are handled during `readdir` operations. The bug is in `fuse_add_dirent_to_cache()`, where an attacker-controlled serialized FUSE directory entry can be copied into a single 4 KiB cache page without verifying that the entry itself fits, causing a **24-byte overflow** and adjacent memory corruption on affected systems. Reports say a malicious FUSE server can trigger the issue through oversized filename data returned to the kernel. Researchers demonstrated exploitation by corrupting cached bytes associated with a SUID binary such as **`/usr/bin/su`**, including a proof of concept that modified the cached `.init` page on Ubuntu 26.04 to execute code that calls `setuid(0)` and `setgid(0)` before spawning a root shell. The vulnerable logic was introduced in 2018, but practical exploitation reportedly became reachable with Linux `v6.16-rc1` after a 2025 increase to the `readdir` buffer size. An upstream patch has been accepted to reject directory entries whose serialized size exceeds `PAGE_SIZE` before caching, while interim mitigations include limiting FUSE use, removing the SUID bit from `fusermount3` where unnecessary, and restricting unprivileged user namespaces.
Aug 20, 2026
A critical flaw tracked as **CVE-2026-47187** affects **SSHFS** versions earlier than **3.7.6**, allowing a malicious or rogue **SFTP** server to trigger local file read or write on a client system through crafted symlinks. The issue stems from SSHFS passing absolute symlink targets or relative targets containing `..` traversal components through FUSE, after which the local kernel VFS can resolve those paths outside the mounted filesystem. If a user or client-side tool such as `cp`, `rsync`, backup software, or an editor follows the link, local readable files can be exposed or attacker-controlled data can be written into writable local files, including startup or scheduled-task locations. The fix was merged into **libfuse/sshfs** as a new **`contain_symlinks`** protection that is enabled by default and rejects absolute symlink targets and any target containing `..`, returning **`EPERM`**. Maintainers described the approach as intentionally strict and lexical because an adversarial filesystem can manipulate intermediate path components, making depth-based checks unreliable. The update also adds a **`no_contain_symlinks`** opt-out for trusted legacy environments, updates documentation, and includes tests covering blocked traversal attempts, safe symlinks, option precedence, and interactions with `transform_symlinks`.
Aug 19, 2026
Tuxera released **NTFS-3G 2026.9.18** to remediate eight vulnerabilities in the FUSE-based NTFS filesystem driver. The flaws include heap buffer overflows, heap data corruption, out-of-bounds reads and writes, and a denial-of-service condition in code handling NTFS attributes, mapping-pair decompression, extended attributes, restart areas, security identifiers, ACL ownership, and inode extent attachment. The highest reported severity is CVSS 6.8 (Moderate), affecting a heap buffer overflow in `ntfs_same_sid()`. Tuxera also issued patch bundles for the 2022.10.3 and 2026.7.7 branches, while Fedora shipped advisory **FEDORA-2026-a2beb6a664** for affected Fedora 46 packages, including `ntfs-3g`, `ntfs-3g-system-compression`, `partclone`, `testdisk`, and `wimlib`. The update additionally corrects ACL-inheritance behavior and defects in `ntfscat` and `ntfsresize`; CVE identifiers had been requested but were not assigned at disclosure, and no known exploits were reported.
Sep 27, 2026