CVE-2026-33150 Use After Free in libfuse
A local attacker can trigger a use-after-free in libfuse's io_uring subsystem to crash processes or execute arbitrary code, particularly in containerized environments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33150?
CVE-2026-33150 is a high-severity use after free vulnerability in libfuse, published on 20 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2.
Which versions are affected by CVE-2026-33150?
It affects 1 product.
Products include Libfuse Project Libfuse.
How do I fix CVE-2026-33150?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-33150 being exploited?
There is no known exploitation of CVE-2026-33150 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in libfuse
Sources
Also known as BELL-CVE-2026-33150, DEBIAN-CVE-2026-33150, GHSA-qxv7-xrc2-qmfx.