Executive brief
The Linux kernel's fuse filesystem driver can crash when mounting submounts if memory allocation fails under resource constraints. An attacker or legitimate user attempting to access files on a fuse-based system under high memory pressure could trigger a system crash, resulting in denial of service and interruption of system availability.
Technical details
The fuse_fill_super_submount() function in the Linux kernel fails to check if fuse_iget() returns NULL when inode allocation fails under memory pressure. This causes a null-pointer dereference when the code calls get_fuse_inode(root) and decrements fi->nlookup on the NULL pointer, resulting in writes to invalid memory addresses. The vulnerability occurs during submount creation, either via auto-submount or explicit submount paths. The fix returns -ENOMEM on allocation failure, allowing the caller to properly tear down the partially built superblock instead of dereferencing NULL.
Affected products
- Linux Linux kernel before fix (approximately 6.6 and later with fuse submount support)
Timeline
- 2026-09-17: disclosed