CVE-2026-33179: 
Homebrew vulnerability analysis and mitigation

CVE-2026-33179 is a NULL pointer dereference and memory leak vulnerability in the fuse_uring_init_queue function of libfuse, the reference implementation of the Linux FUSE (Filesystem in Userspace) interface. It affects libfuse versions 3.18.0 through 3.18.1 (including 3.19.0-rc0) and was disclosed on March 20, 2026, with a patch released in version 3.18.2. Only the io_uring transport is affected; the traditional /dev/fuse path is not impacted. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is classified as CWE-476 (NULL Pointer Dereference), with a secondary memory leak issue. In lib/fuse_uring.c, the fuse_uring_init_queue() function calls numa_alloc_local() to allocate request headers and payloads for io_uring queue entries without checking the return value; if the allocation fails, the code proceeds with NULL pointers, leading to a NULL pointer dereference when SQE registration subsequently accesses those buffers. Additionally, when fuse_uring_register_queue() fails, the function incorrectly falls through to return queue->ring.ring_fd (indicating success) instead of propagating the error, causing NUMA allocations to be leaked and the caller to use a broken queue for I/O. The fix adds explicit NULL checks after each numa_alloc_local() call and ensures errors from fuse_uring_register_queue() are properly returned, with cleanup delegated to fuse_session_destruct_uring() (GitHub Commit, GitHub Advisory).

A local user with low privileges can exploit this vulnerability to crash the FUSE daemon (denial of service) or cause resource exhaustion through repeated memory leaks. Crashing the FUSE daemon can interrupt critical filesystem operations that depend on FUSE-mounted filesystems, impacting system availability. Repeated triggering of the memory leak path can degrade system performance over time. There is no impact on confidentiality or integrity (GitHub Advisory).

No public proof-of-concept exploit code has been released, though a PoC was confirmed internally using AddressSanitizer and LeakSanitizer and is available upon request from the reporter. There is no evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), reflecting a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the attack surface (GitHub Advisory).

1. Identify target: Confirm the target system is running libfuse version 3.18.0 or 3.18.1 with the io_uring transport enabled (not the traditional /dev/fuse path).
2. Obtain local access: Gain a low-privileged local user account on the target system.
3. Trigger NUMA allocation failure: Cause memory pressure or NUMA allocation failure conditions on the system so that numa_alloc_local() returns NULL during io_uring queue entry setup in fuse_uring_init_queue().
4. Crash the FUSE daemon: The NULL pointer dereference occurs when the SQE registration code accesses the NULL req_header or op_payload buffers, causing the FUSE daemon to crash and interrupting any FUSE-mounted filesystem operations.
5. Cause resource exhaustion (alternative path): Repeatedly trigger fuse_uring_register_queue() failures to cause NUMA memory to be leaked without being freed, gradually exhausting system memory resources (GitHub Advisory, GitHub Commit).

• Logs: Unexpected FUSE daemon crash logs or kernel messages referencing NULL pointer dereferences in fuse_uring_init_queue; log entries such as qid=<N> io_uring init failed in FUSE daemon output.
• System Behavior: Sudden unavailability of FUSE-mounted filesystems; repeated FUSE daemon restarts or exits.
• Resource Monitoring: Gradual increase in memory consumption by the FUSE daemon process without corresponding release, detectable via tools like valgrind, LeakSanitizer, or system memory monitoring utilities.
• Process: FUSE daemon process terminating unexpectedly, particularly when io_uring transport is in use.

Upgrade libfuse to version 3.18.2 or later, which contains the fix for both the NULL pointer dereference and the memory leak (libfuse Release). If immediate patching is not possible, disable the io_uring transport and revert to the traditional /dev/fuse path, which is not affected by this vulnerability. Additionally, restrict local user access to FUSE daemon operations where feasible, and monitor for unexpected FUSE daemon crashes or abnormal memory consumption (GitHub Advisory).

The vulnerability was discovered and reported by Abhinav Agarwal, a Senior Software Developer at Rubrik, and was discussed on the oss-security mailing list and Hacker News shortly after disclosure (oss-sec, Hacker News). The issue was also noted in the Full Disclosure mailing list and covered by Linux-focused outlets such as Pro-Linux.de and LinuxCompatible.org (Pro-Linux). Detection plugins were subsequently released by Tenable (Nessus plugin 303266) and Qualys (detection ID 711163).