NULL Pointer Dereference and Memory Leak in libfuse Affecting Linux Systems
CVE-2026-33179

5.5MEDIUM

Key Information:

Vendor

Libfuse

Status
Libfuse
Vendor
CVE Published:
20 March 2026

What is CVE-2026-33179?

A vulnerability in libfuse, the reference implementation of the Linux FUSE, allows a local user to exploit a NULL pointer dereference and cause memory leaks during io_uring queue entry setup. The issue occurs when NUMA allocations fail, leading to the incorrect handling of NULL pointers and allowing the FUSE daemon to crash or exhaust system resources. This affects only the io_uring transport; the traditional /dev/fuse path remains unaffected. The vulnerability was patched in version 3.18.2.

Affected Version(s)

libfuse >= 3.18.0, < 3.18.2

References

https://github.com/libfuse/libfuse/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/libfuse/libfuse/commit/7beb86c09b6ec5a...
x_refsource_MISC
https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.