CVE-2026-53167 fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
An attacker can read uninitialized kernel memory via FUSE_NOTIFY_RETRIEVE if automatic zero-initialization is disabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53167?
CVE-2026-53167 is a medium-severity vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
FUSE_NOTIFY_RETRIEVE must be limited to uptodate folios; !uptodate folios can contain uninitialized data. Since FUSE_NOTIFY_RETRIEVE is intended to only return data that is already in the page cache and not wait for data from the FUSE daemon, treat !uptodate folios as if they weren't present.
This only has security impact on systems that don't enable automatic zero-initialization of all page allocations via CONFIG_INIT_ON_ALLOC_DEFAULT_ON or init_on_alloc=1.
Weakness: CWE-908
Which versions are affected by CVE-2026-53167?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53167?
Apply the vendor's patch.
Is CVE-2026-53167 being exploited?
There is no known exploitation of CVE-2026-53167 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90761, BELL-CVE-2026-53167, DEBIAN-CVE-2026-53167, GHSA-vg6g-9h68-878w, OESA-2026-3530, ROOT-OS-DEBIAN-11-CVE-2026-53167 and 5 more.