Executive brief
A vulnerability was identified in the Linux kernel's file system component that could allow a local user to cause a system crash. The issue stems from the use of uninitialized data when retrieving file attributes, particularly affecting systems using the FUSE (Filesystem in Userspace) framework. This could lead to a denial-of-service condition, impacting the availability of the affected system.
Technical details
A use of uninitialized resource vulnerability (CWE-908) exists in the Linux kernel's fs/file_attr.c. The 'file_kattr' structure was not properly initialized before being passed to vfs_fileattr_get(), specifically leaving the 'flags_valid' field in an indeterminate state. This was reported by syzbot as an 'uninit-value' bug in fuse_fileattr_get. A local attacker with low privileges can trigger this code path via the file_getattr system call. The vulnerability can result in a kernel panic or unexpected behavior (Denial of Service). Patches have been released for various stable branches including 6.18.y and 6.19.y.
Affected products
- Linux Linux Kernel 6.17 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1, 7.0-rc2
Timeline
- 2026-02-06: patched: Initial patch authored
- 2026-05-08: disclosed: CVE published
- 2026-05-21: advisory: NVD enrichment and analysis updated