{"id":"CVE-2026-33150","aliases":["BELL-CVE-2026-33150","DEBIAN-CVE-2026-33150","EUVD-2026-13786","GHSA-qxv7-xrc2-qmfx","UBUNTU-CVE-2026-33150"],"status":"published","title":"Use After Free in libfuse","description":"libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00322,"percentile":0.25401,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-416","CWE-825"],"published":"2026-03-20T20:20:29Z","modified":"2026-10-28T11:11:47Z","exploits":[{"source":"pocgithub","id":"abhinavagarwal07/abhinavagarwal07.github.io","title":"abhinavagarwal07/abhinavagarwal07.github.io","date":"2026-03-25","url":"https://github.com/abhinavagarwal07/abhinavagarwal07.github.io"}],"fixes":[{"ecosystem":"Alpaquita:stream","package":"fuse3","fixed_in":["3.18.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fuse3","fixed_in":["3.18.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.18.1-r0"},{"fixed":"3.18.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"fuse3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.2-1"}]}],"versions":["3.17.2-3","3.17.3-1","3.17.4-1","3.18.1-1"]}],"products":[{"vendor":"libfuse","product":"libfuse"},{"vendor":"libfuse_project","product":"libfuse"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"}],"references":[{"url":"https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","report"]},{"url":"https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2","tags":["x_refsource_MISC","Product","Release Notes","web","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33150","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449771","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33150.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-33150","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33150.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33150","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-33150","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-33150","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33150","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-33150","title":"Use After Free in libfuse","description":"libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2.","status":"published","published":"2026-03-20T20:20:29.963Z","modified":"2026-07-15T01:07:15.081Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-416","CWE-825"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-13786","description":"libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2.","status":"published","published":"2026-03-20T20:20:29Z","modified":"2026-07-15T01:07:15Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:56.47701Z"}],"nvd":[{"id":"CVE-2026-33150","description":"libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2.","status":"published","published":"2026-03-20T21:17:15.41Z","modified":"2026-07-15T02:20:03.623Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-416","CWE-825"],"updated_at":"2026-11-02T14:12:10.126802Z"}],"osv":[{"id":"BELL-CVE-2026-33150","status":"published","published":"2026-03-27T06:08:21.164638Z","modified":"2026-03-28T07:16:02.154456Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"CVE-2026-33150","title":"Use After Free in libfuse","description":"libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2.","status":"published","published":"2026-03-20T20:20:29.963Z","modified":"2026-10-28T11:11:47.82097619Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"DEBIAN-CVE-2026-33150","description":"libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2.","status":"published","published":"2026-03-20T21:17:15.41Z","modified":"2026-10-01T03:02:36.688990224Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"UBUNTU-CVE-2026-33150","description":"libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2.","status":"withdrawn","published":"2026-03-20T21:17:00Z","modified":"2026-07-28T21:28:01.034105136Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"}]}}