Junglewise Threat Intelligence

CVE-2026-90139: Linux kernel fuse null pointer dereference in submount

CVE-2026-90139 · Severity: info · Published 2026-09-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's fuse filesystem driver can crash when mounting submounts if memory allocation fails under resource constraints. An attacker or legitimate user attempting to access files on a fuse-based system under high memory pressure could trigger a system crash, resulting in denial of service and interruption of system availability.

Technical details

The fuse_fill_super_submount() function in the Linux kernel fails to check if fuse_iget() returns NULL when inode allocation fails under memory pressure. This causes a null-pointer dereference when the code calls get_fuse_inode(root) and decrements fi->nlookup on the NULL pointer, resulting in writes to invalid memory addresses. The vulnerability occurs during submount creation, either via auto-submount or explicit submount paths. The fix returns -ENOMEM on allocation failure, allowing the caller to properly tear down the partially built superblock instead of dereferencing NULL.

Affected products

  • Linux Linux kernel before fix (approximately 6.6 and later with fuse submount support)

Timeline

  • 2026-09-17: disclosed

Related threats