Improper Input Validation in FuseFS File System by FreeBSD

CVE-2026-45252

What is CVE-2026-45252?

The FuseFS file system in FreeBSD is susceptible to an improper input validation vulnerability. When handling extended attributes, the kernel sends a request to a userspace daemon via a FUSE_LISTXATTR message. This interaction requires the daemon to craft a list of NUL-terminated strings. However, the kernel module fails to verify that the entire list is properly NUL-terminated before processing it. As a result, if a malicious daemon sends a list without proper termination, this could lead to out-of-bounds reads and writes, allowing potential disclosure of sensitive kernel memory and the injection of attacker-controlled bytes into the kernel heap.

References