CVE-2026-31713: Linux Kernel FUSE DoS Vulnerability

CVE-2026-31713 Overview

CVE-2026-31713 is a denial-of-service vulnerability in the Linux kernel's Filesystem in Userspace (FUSE) implementation. When synchronous initialization (sync init) is used and the FUSE server exits while processing FUSE_INIT, filesystem creation hangs indefinitely. The mounting thread retains the device file descriptor open, which prevents the abort path from executing. This is a regression introduced when the kernel transitioned to handling sync mounts that perform FUSE_INIT before the mount completes.

Critical Impact
A local user invoking a synchronous FUSE mount can trigger a kernel-level hang in filesystem creation if the userspace FUSE server crashes during FUSE_INIT, resulting in resource exhaustion and impacting system availability.

Affected Products

Linux Kernel (mainline, including release 7.1:rc1)
Linux Kernel stable branches receiving the FUSE sync init backport
Distributions shipping kernels with the FUSE sync mount feature enabled

Discovery Timeline

2026-05-01 - CVE-2026-31713 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-31713

Vulnerability Analysis

The vulnerability resides in the Linux kernel FUSE subsystem and manifests during synchronous mount initialization. FUSE allows non-privileged users to create filesystems in userspace by pairing a kernel-side device with a userspace daemon. During sync init, the kernel issues FUSE_INIT to the userspace server before completing mount setup.

If the FUSE server process exits unexpectedly during FUSE_INIT handling, the kernel expects an abort sequence to clean up pending state. However, the mounting thread itself holds the FUSE device file descriptor open through a recursive syscall path. The reference count on the device fd never reaches zero, so the abort never fires, and the mount call blocks indefinitely.

The issue is a regression from the asynchronous mount pattern, where the mount completed before FUSE_INIT ran. In that earlier design, no recursive syscall held the descriptor, allowing standard cleanup to proceed when the server exited.

Root Cause

The root cause is the lifetime of the FUSE device file descriptor during synchronous initialization. The mounting thread's open handle on the device prevents the kernel from observing the userspace server's exit and from triggering the abort path that would unblock filesystem creation.

Attack Vector

Exploitation requires local access with privileges sufficient to invoke a FUSE mount. A user mounts a FUSE filesystem in sync mode, and the cooperating userspace FUSE server terminates abnormally during FUSE_INIT processing. The mount syscall hangs, consuming a kernel thread and leaving the partially constructed filesystem state in place. Repeated triggers can exhaust resources and degrade system availability. The vulnerability does not provide code execution or information disclosure.

For technical details on the fix, see the upstream kernel commits at kernel.org commit 0c7fca88, kernel.org commit 204aa22a, and kernel.org commit 300e812b.

Detection Methods for CVE-2026-31713

Indicators of Compromise

Mount processes stuck in uninterruptible sleep (D state) with stack traces pointing into FUSE init paths
Userspace FUSE server processes that exited or crashed shortly before a hung mount call
Growing count of zombie or hung mount syscalls referencing /dev/fuse

Detection Strategies

Monitor kernel logs and dmesg output for FUSE-related warnings or stalled task messages from hung_task_timeout_secs
Audit process state for mount.fuse or equivalent helpers blocked on kernel waits beyond expected initialization windows
Correlate userspace FUSE daemon crash signals (SIGSEGV, SIGABRT) with subsequent unresponsive mount operations

Monitoring Recommendations

Track invocation rates of FUSE mounts and the lifetime of associated userspace daemons
Alert when mount syscalls exceed reasonable duration thresholds, particularly when paired with FUSE server termination
Capture kernel stack traces from blocked mount threads to confirm involvement of FUSE_INIT processing

How to Mitigate CVE-2026-31713

Immediate Actions Required

Apply the upstream kernel patches referenced in the linked git.kernel.org commits as soon as your distribution publishes them
Restrict the ability to perform user-namespace or unprivileged FUSE mounts to trusted accounts where feasible
Reboot affected systems after patching to ensure the updated kernel is active

Patch Information

Fixes are available in the upstream Linux kernel via three stable commits: 0c7fca880a40, 204aa22a686b, and 300e812b882a. The patches abort filesystem creation when a fatal signal is received during sync init, releasing the device fd and unblocking the mount path. Track distribution security advisories for the corresponding backported kernel package versions.

Workarounds

Avoid using synchronous FUSE init mounts on affected kernels; prefer asynchronous mounts where supported by the FUSE server
Constrain unprivileged FUSE usage through /proc/sys/fs/fuse/ controls, mount namespaces, or LSM policies (AppArmor, SELinux)
Implement watchdogs that terminate stalled mount processes and reclaim resources until patches can be applied

bash

# Check installed kernel version and FUSE module status
uname -r
modinfo fuse | grep -E 'version|filename'

# Restrict unprivileged FUSE mounts via sysctl (where supported)
sysctl -w kernel.unprivileged_userns_clone=0

# Identify hung mount processes potentially affected by this issue
ps -eo pid,stat,wchan:32,cmd | awk '$2 ~ /D/ && /fuse/'