Linux Kernel Vulnerability in FUSE Dentry Revalidation Process

CVE-2026-53311

What is CVE-2026-53311?

The Linux kernel's file system implementation for FUSE has a vulnerability that occurs during the dentry revalidation process. Specifically, the function fuse_dentry_revalidate() can be invoked with a dentry that has not had its ->d_time initialized. This oversight was identified using KMSAN, which reported an issue related to uninitialized values, potentially allowing for erratic behavior during file operations. This vulnerability could lead to unexpected consequences in file handling within the FUSE file system.

References