CVE-2026-33150: Libfuse Use-After-Free Vulnerability

CVE-2026-33150 Overview

CVE-2026-33150 is a use-after-free vulnerability affecting libfuse, the reference implementation of the Linux FUSE (Filesystem in Userspace) interface. The vulnerability exists in the io_uring subsystem of libfuse versions 3.18.0 through 3.18.1, allowing local attackers to crash FUSE filesystem processes and potentially achieve arbitrary code execution.

When io_uring thread creation fails due to resource exhaustion conditions—such as cgroup pids.max limits being reached—the fuse_uring_start() function frees the ring pool structure but incorrectly stores a dangling pointer in the session state. This dangling pointer is subsequently accessed when the FUSE session shuts down, triggering the use-after-free condition.

Critical Impact
Local attackers can exploit this vulnerability to crash FUSE filesystem processes and potentially execute arbitrary code. The trigger is particularly reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation.

Affected Products

libfuse versions 3.18.0 to 3.18.1

Discovery Timeline

2026-03-20 - CVE-2026-33150 published to NVD
2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-33150

Vulnerability Analysis

This use-after-free vulnerability (CWE-416) occurs within the io_uring subsystem of libfuse. The io_uring interface is a high-performance asynchronous I/O mechanism in Linux, and libfuse leverages this for improved filesystem operation throughput. The vulnerability emerges during error handling when io_uring thread creation fails.

The flaw is particularly impactful in containerized environments where resource constraints are common. Container orchestration platforms frequently impose pids.max cgroup limits to prevent fork bombs and resource exhaustion attacks. These legitimate security controls inadvertently create the exact conditions needed to trigger this vulnerability reliably.

When exploited, an attacker with local access can cause denial of service by crashing FUSE-mounted filesystems. More critically, the use-after-free condition opens the door to arbitrary code execution if the attacker can control the memory contents at the freed location before the dangling pointer is dereferenced.

Root Cause

The root cause lies in improper memory management during error handling in the fuse_uring_start() function. When io_uring thread creation fails due to resource exhaustion, the function correctly frees the allocated ring pool structure. However, it fails to clear or nullify the pointer stored in the session state, leaving a dangling reference. During session shutdown, the cleanup code attempts to access this already-freed memory, resulting in the use-after-free condition.

Attack Vector

The attack vector is local, requiring an attacker to have local access to the system running a vulnerable version of libfuse. The exploitation process involves:

Identifying a system using libfuse versions 3.18.0 or 3.18.1 with io_uring enabled
Triggering resource exhaustion conditions, particularly by manipulating cgroup pids.max limits in containerized environments
Causing the fuse_uring_start() function to fail during thread creation
Waiting for or triggering a FUSE session shutdown to access the dangling pointer
Potentially controlling freed memory contents for code execution

The vulnerability is especially concerning in multi-tenant container environments where attackers may have limited access to manipulate their own cgroup constraints while affecting shared FUSE filesystems.

Detection Methods for CVE-2026-33150

Indicators of Compromise

Unexpected FUSE filesystem process crashes, particularly during shutdown operations
Segmentation faults or memory corruption errors in FUSE-related processes
Log entries indicating io_uring thread creation failures followed by process termination
Anomalous memory access patterns in FUSE daemon processes

Detection Strategies

Monitor for FUSE process crashes with memory corruption signatures in system logs
Implement runtime memory debugging tools (AddressSanitizer, Valgrind) in development and testing environments to detect use-after-free conditions
Track cgroup pids.max limit violations that may indicate exploitation attempts
Deploy endpoint detection solutions capable of identifying memory corruption exploitation patterns

Monitoring Recommendations

Enable core dump collection for FUSE processes to facilitate forensic analysis
Configure alerting for repeated FUSE daemon restarts or unexpected terminations
Monitor container orchestration logs for unusual cgroup limit interactions
Implement process monitoring for FUSE-related binaries to detect anomalous behavior patterns

How to Mitigate CVE-2026-33150

Immediate Actions Required

Upgrade libfuse to version 3.18.2 or later immediately
Audit systems for vulnerable libfuse versions (3.18.0 through 3.18.1)
Prioritize patching containerized environments where the vulnerability is most easily triggered
Review and restrict local access to systems running critical FUSE filesystems

Patch Information

The libfuse project has released version 3.18.2 which addresses this vulnerability. The fix ensures proper pointer management when io_uring thread creation fails, preventing the dangling pointer condition.

For detailed patch information, refer to the following resources:

Workarounds

If immediate patching is not possible, consider disabling io_uring support in libfuse configurations where feasible
Implement additional cgroup monitoring to detect and alert on pids.max limit violations
Restrict local access to systems running vulnerable libfuse versions
In containerized environments, carefully review and adjust pids.max limits to balance security controls with operational stability

bash

# Verify libfuse version and upgrade
# Check current version
fusermount3 --version

# On Debian/Ubuntu systems, update to patched version
sudo apt update && sudo apt install libfuse3-3

# On RHEL/CentOS/Fedora systems
sudo dnf update fuse3-libs

# Verify upgrade was successful
fusermount3 --version