CVE-2026-53168 Overview
CVE-2026-53168 is a Linux kernel vulnerability in the Filesystem in Userspace (FUSE) subsystem. The flaw allows a FUSE daemon to issue FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE pagecache operations against directories that use FOPEN_CACHE_DIR. Because the directory pagecache is intended only as kernel-internal cache storage, userspace-directed writes can place malformed data in the cache. When fuse_parse_cache() later processes that data, it triggers a WARN_ON() condition. The fix rejects these notify operations on anything other than regular files, returning -EINVAL.
Critical Impact
A malicious or buggy FUSE daemon can corrupt kernel directory cache contents, producing kernel warnings and potential denial-of-service conditions on systems mounting FUSE filesystems.
Affected Products
- Linux kernel versions implementing FUSE FOPEN_CACHE_DIR directory caching
- Distributions shipping affected stable kernels prior to the patches referenced below
- Systems permitting unprivileged FUSE mounts via fusermount
Discovery Timeline
- 2026-06-25 - CVE-2026-53168 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53168
Vulnerability Analysis
The Linux FUSE subsystem permits userspace daemons to manage filesystem operations through a kernel interface. Two notify operations, FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE, allow the daemon to write and read pagecache contents associated with FUSE inodes. These operations were designed for regular file content caching.
Directories opened with the FOPEN_CACHE_DIR flag also use the pagecache, but as a kernel-internal structure holding parsed directory entries. The kernel function fuse_parse_cache() assumes this cache contains well-formed entries written only by the kernel. The vulnerability stems from missing input validation: the notify handlers did not restrict targets to regular files, allowing a FUSE daemon to inject arbitrary bytes into directory cache pages.
This is classified as an [CWE-20] Improper Input Validation issue in a kernel filesystem driver. Exploitation requires the ability to operate a FUSE daemon, which on many distributions is available to unprivileged users through fusermount.
Root Cause
The FUSE notify handlers for FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE lacked a check on the inode type. They accepted operations on directory inodes even though directory pagecache is reserved for kernel-managed cached fuse_dirent data.
Attack Vector
A local attacker running a malicious FUSE server mounts a filesystem that advertises FOPEN_CACHE_DIR on directory open. The daemon then issues FUSE_NOTIFY_STORE with crafted bytes targeting the directory inode. When a process subsequently reads the directory, fuse_parse_cache() encounters bogus entries and hits the WARN_ON() path, producing kernel taint, log spam, and potential follow-on instability.
The fix, applied across multiple stable branches including commits 12df4cfa738a, 15487f98863d, 99c317d7f8b7, 9c954499d43a, 9dbf1b2fadfc, bd23fa0c16c5, dd92773d4d9c, and e692f0cb8620, returns -EINVAL when the target inode is not a regular file. See the Kernel Git Patch 1 for the canonical change.
Detection Methods for CVE-2026-53168
Indicators of Compromise
- Kernel WARN_ON() traces originating in fuse_parse_cache() or adjacent FUSE directory readdir paths
- Unexpected dmesg entries referencing FUSE directory cache corruption or malformed fuse_dirent data
- Repeated mounts and unmounts of FUSE filesystems by non-root users immediately preceding kernel warnings
Detection Strategies
- Monitor kernel logs for FUSE-related stack traces and tainted kernel state on systems where unprivileged users can run fusermount
- Audit running processes for unfamiliar FUSE daemons launched by low-privilege accounts
- Track mount syscalls with fuse or fuse.* filesystem types via auditd or eBPF tracing
Monitoring Recommendations
- Forward /var/log/kern.log and journalctl -k output to a centralized logging or SIEM platform and alert on FUSE warning signatures
- Baseline expected FUSE filesystem usage per host and flag deviations
- Apply file integrity monitoring to /etc/fuse.conf to detect changes that broaden user_allow_other or similar permissions
How to Mitigate CVE-2026-53168
Immediate Actions Required
- Apply the latest stable Linux kernel update from your distribution that includes the FUSE notify validation patches listed in the references
- Reboot affected systems after kernel installation to load the patched kernel image
- Inventory hosts that permit unprivileged FUSE mounts and prioritize them for patching
Patch Information
The upstream fix rejects FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE against non-regular-file inodes with -EINVAL. The patch is available across multiple stable kernel branches. Refer to the Kernel Git Patch 1, Kernel Git Patch 2, Kernel Git Patch 3, Kernel Git Patch 4, Kernel Git Patch 5, Kernel Git Patch 6, Kernel Git Patch 7, and Kernel Git Patch 8 for the exact backports.
Workarounds
- Restrict the fuse and fusermount binaries to trusted users by tightening file permissions and removing the user_allow_other directive in /etc/fuse.conf
- Disable or unload the fuse kernel module on systems that do not require FUSE filesystems
- Use mandatory access control policies such as SELinux or AppArmor to confine FUSE daemons run by unprivileged users
# Configuration example: restrict FUSE usage until patched
sudo chmod 750 /usr/bin/fusermount3
sudo sed -i 's/^user_allow_other/#user_allow_other/' /etc/fuse.conf
# Optionally prevent module load on hosts that do not need FUSE
echo 'install fuse /bin/true' | sudo tee /etc/modprobe.d/disable-fuse.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
