CVE-2026-33179

A flaw was found in libfuse. A local user can exploit a NULL pointer dereference and memory leak vulnerability during the setup of the io_uring input/output mechanism. This can occur when memory allocation or queue registration fails, leading to the FUSE daemon crashing or resource exhaustion. This vulnerability results in a Denial of Service (DoS).

A local user can cause a Denial of Service (DoS) in the FUSE daemon due to a NULL pointer dereference and memory leak during io_uring setup. This issue affects libfuse versions from 3.18.0 to before 3.18.2 when using the io_uring transport. The traditional /dev/fuse path is not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.