Executive brief
A vulnerability was identified in the Linux kernel's FUSE (Filesystem in Userspace) component. This issue could allow a local user to trigger unpredictable system behavior or minor stability issues due to the use of uninitialized memory during file path lookups. While primarily a technical bug, it represents a flaw in how the system validates file access requests.
Technical details
A vulnerability exists in the Linux kernel FUSE implementation where fuse_dentry_revalidate() accesses the d_time field of a dentry before it has been initialized. This occurs because lookup_open() calls __d_alloc() followed by d_revalidate() before the FUSE-specific initialization has occurred. An attacker with local access could potentially exploit this uninitialized value to bypass intended cache invalidation logic or cause minor kernel memory corruption/instability. The fix involves explicitly initializing d_time to zero in fuse_dentry_init(), ensuring the dentry is treated as invalid until properly processed. Patches have been released for various stable kernel branches including 6.18.34 and 7.0.10.
Affected products
- Linux Linux Kernel 6.16 to 6.18.34, 7.0.10
Timeline
- 2026-02-16: other: Patch authored
- 2026-06-26: disclosed: CVE published