Vulnerability · Published Mar 20, 2026 · Assigned by GitHub_M

CVE-2026-33179libfuse: NULL Pointer Dereference and Memory Leak in io_uring Queue Initialization

Medium 5.5

In plain English

A medium-severity null pointer dereference in libfuse from libfuse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.2%top 89.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a NULL pointer dereference and memory leak in fuse_uring_init_queue allows a local user to crash the FUSE daemon or cause resource exhaustion. When numa_alloc_local fails during io_uring queue entry setup, the code proceeds with NULL pointers. When fuse_uring_register_queue fails, NUMA allocations are leaked and the function incorrectly returns success. Only the io_uring transport is affected; the traditional /dev/fuse path is not affected. PoC confirmed with AddressSanitizer/LeakSanitizer. This issue has been patched in version 3.18.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	fuse3	3.18.2-1	DEBIAN-CVE-2026-33179
Ubuntu:26.04:LTS	fuse3	no fix listed	UBUNTU-CVE-2026-33179

Affected products (as reported)

Vendor	Product	Versions
libfuse	libfuse	>= 3.18.0, < 3.18.2

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/libfuse/libfuse/security/advisories/GHSA-x669-v3mq-r358 x_refsource_CONFIRM
https://github.com/libfuse/libfuse/commit/7beb86c09b6ec5aab14dc25256ed8a5ad18554d7 x_refsource_MISC
https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2 x_refsource_MISC