CVE-2026-53167: Linux Kernel Privilege Escalation Flaw

CVE-2026-53167 Overview

CVE-2026-53167 is a Linux kernel vulnerability in the Filesystem in Userspace (FUSE) subsystem. The flaw involves the FUSE_NOTIFY_RETRIEVE operation, which fails to restrict reads to uptodate folios in the page cache. As a result, non-uptodate folios containing uninitialized memory contents can be returned to userspace, leading to information disclosure.

The issue only affects systems that do not enable automatic zero-initialization of page allocations through CONFIG_INIT_ON_ALLOC_DEFAULT_ON or the init_on_alloc=1 boot parameter. Upstream maintainers resolved the issue by treating non-uptodate folios as if they were not present.

Critical Impact
A local FUSE daemon can retrieve uninitialized kernel page data through FUSE_NOTIFY_RETRIEVE, potentially exposing sensitive memory contents on kernels without init_on_alloc enabled.

Affected Products

Linux kernel (FUSE subsystem) — versions prior to the fix commits
Distributions shipping kernels without CONFIG_INIT_ON_ALLOC_DEFAULT_ON
Systems not booted with init_on_alloc=1

Discovery Timeline

2026-06-25 - CVE-2026-53167 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53167

Vulnerability Analysis

FUSE allows userspace processes to implement filesystems through a kernel-userspace protocol. The FUSE_NOTIFY_RETRIEVE notification lets a FUSE daemon request data already cached in the kernel page cache for a given inode and offset range. By design, the operation must only return data that is present and valid in the page cache, without triggering reads from the backing daemon.

The vulnerability stems from the kernel returning folios that are present in the cache but flagged as not uptodate. A non-uptodate folio has been allocated but has not yet been populated with valid file data. Its contents are whatever the page allocator returned, which may include stale data from previously freed kernel pages.

The security impact is conditional. Kernels built with CONFIG_INIT_ON_ALLOC_DEFAULT_ON, or booted with init_on_alloc=1, zero every page on allocation and are not affected. Kernels without this hardening can leak arbitrary uninitialized kernel memory to the FUSE daemon.

Root Cause

The root cause is missing validation of the folio uptodate flag inside the FUSE_NOTIFY_RETRIEVE handler. The handler walked the page cache and copied folio contents to the response buffer without checking whether the folio held valid file data, resulting in Uninitialized Memory Use and Information Disclosure.

Attack Vector

Exploitation requires the ability to operate a FUSE daemon and trigger FUSE_NOTIFY_RETRIEVE against an inode whose page cache contains non-uptodate folios. An unprivileged local user with permission to mount FUSE filesystems can populate the page cache with allocated-but-not-yet-read folios, then issue retrieve notifications to read back the uninitialized contents. No remote attack vector is described in the advisory.

No public exploit code is referenced in the advisory. Technical details are available in the upstream commits: 1fb8735a3a4d, 4e3d1b2c48ca, and 56763afa0134.

Detection Methods for CVE-2026-53167

Indicators of Compromise

Unprivileged processes mounting FUSE filesystems and issuing high volumes of FUSE_NOTIFY_RETRIEVE operations against arbitrary inodes.
Userspace FUSE daemons reading page-aligned data ranges without corresponding read requests from clients.
Kernels running without init_on_alloc=1 or CONFIG_INIT_ON_ALLOC_DEFAULT_ON set in /proc/config.gz.

Detection Strategies

Audit running kernel configuration for the init_on_alloc setting using cat /proc/cmdline and zcat /proc/config.gz | grep INIT_ON_ALLOC.
Inventory installed kernel package versions and compare against the fix commits in the stable trees.
Monitor auditd for mount syscalls invoking fuse or fuse.* filesystem types from non-root users.

Monitoring Recommendations

Log creation of FUSE mounts via fusermount and fusermount3 and correlate with the invoking user.
Track anomalous FUSE protocol traffic patterns, particularly bursts of retrieve notifications.
Alert on systems running kernel versions older than the patched stable releases identified in the upstream commits.

How to Mitigate CVE-2026-53167

Immediate Actions Required

Update to a Linux kernel version that includes the fix commits referenced in the advisory.
Enable init_on_alloc=1 on the kernel command line, or rebuild the kernel with CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y, to neutralize the information disclosure.
Restrict unprivileged FUSE mounts where feasible by setting user_allow_other policy and sysctl fs.fuse.allow_other to controlled values.

Patch Information

The fix limits FUSE_NOTIFY_RETRIEVE to uptodate folios and treats non-uptodate folios as if they were not present in the page cache. Patches are available in the stable trees as commits 1fb8735a3a4d, 4e3d1b2c48ca, and 56763afa0134. Apply the distribution kernel update that includes these commits.

Workarounds

Boot the kernel with init_on_alloc=1 to force zero-initialization of all page allocations and eliminate the information leak.
Disable unprivileged user namespaces and FUSE mounts on systems where they are not required.
Limit FUSE daemon execution to trusted users using AppArmor or SELinux policies.

bash

# Add init_on_alloc to the kernel command line (GRUB example)
sudo sed -i 's/^GRUB_CMDLINE_LINUX="\(.*\)"/GRUB_CMDLINE_LINUX="\1 init_on_alloc=1"/' /etc/default/grub
sudo update-grub

# Verify after reboot
cat /proc/cmdline | grep -o 'init_on_alloc=[01]'