CVE-2026-33179 libfuse: NULL Pointer Dereference and Memory Leak in io_uring Queue Initialization
A local attacker can crash the FUSE daemon or exhaust resources via a NULL pointer dereference in the io_uring transport, requiring the io_uring feature to be enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33179?
CVE-2026-33179 is a medium-severity vulnerability in libfuse, published on 20 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a NULL pointer dereference and memory leak in fuse_uring_init_queue allows a local user to crash the FUSE daemon or cause resource exhaustion. When numa_alloc_local fails during io_uring queue entry setup, the code proceeds with NULL pointers. When fuse_uring_register_queue fails, NUMA allocations are leaked and the function incorrectly returns success. Only the io_uring transport is affected; the traditional /dev/fuse path is not affected. PoC confirmed with AddressSanitizer/LeakSanitizer. This issue has been patched in version 3.18.2.
Weakness: CWE-476
Which versions are affected by CVE-2026-33179?
It affects 1 product.
Products include Libfuse Project Libfuse.
How do I fix CVE-2026-33179?
Upgrade to a fixed version.
Is CVE-2026-33179 being exploited?
There is no known exploitation of CVE-2026-33179 in the wild and no public exploit code.
Other vulnerabilities in libfuse
Sources
Also known as BELL-CVE-2026-33179, DEBIAN-CVE-2026-33179, GHSA-x669-v3mq-r358.