CVE-2026-33150

A flaw was found in libfuse. A use-after-free vulnerability in the io_uring subsystem allows a local attacker to potentially execute arbitrary code and crash FUSE (Filesystem in Userspace) filesystem processes. This occurs when io_uring thread creation fails due to resource exhaustion, such as limits imposed by cgroup pids.max, causing a dangling pointer to be stored and later used during session shutdown. This vulnerability is reliably triggered in containerized environments.

An Important use-after-free vulnerability in libfuse's io_uring subsystem can lead to arbitrary code execution or denial of service for local attackers. This flaw is reliably triggered in containerized environments when io_uring thread creation fails due to resource exhaustion, such as cgroup pids.max limits. Red Hat Enterprise Linux 7 is not affected. Red Hat Enterprise Linux 8.10 and Fedora are affected when using fuse-sshfs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.