Skip to main content

Linux Kernel CVE-2026-53311

| EUVDEUVD-2026-39846 MEDIUM
Use of Uninitialized Resource (CWE-908)
2026-06-26 Linux GHSA-32q2-cq6r-mpm8
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access and low-privilege user required to trigger FUSE path; only availability impact confirmed, no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 06, 2026 - 20:34 vuln.today
CVSS changed
Jul 06, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:41 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 26, 2026 - 19:41 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

fuse: fix uninit-value in fuse_dentry_revalidate()

fuse_dentry_revalidate() may be called with a dentry that didn't had ->d_time initialised. The issue was found with KMSAN, where lookup_open() calls __d_alloc(), followed by d_revalidate(), as shown below:

============= BUG: KMSAN: uninit-value in fuse_dentry_revalidate+0x150/0x13d0 fs/fuse/dir.c:394 fuse_dentry_revalidate+0x150/0x13d0 fs/fuse/dir.c:394 d_revalidate fs/namei.c:1030 [inline] lookup_open fs/namei.c:4405 [inline] open_last_lookups fs/namei.c:4583 [inline] path_openat+0x1614/0x64c0 fs/namei.c:4827 do_file_open+0x2aa/0x680 fs/namei.c:4859 [...]

Uninit was created at: slab_post_alloc_hook mm/slub.c:4466 [inline] slab_alloc_node mm/slub.c:4788 [inline] kmem_cache_alloc_lru_noprof+0x382/0x1280 mm/slub.c:4807 __d_alloc+0x55/0xa00 fs/dcache.c:1740 d_alloc_parallel+0x99/0x2740 fs/dcache.c:2604 lookup_open fs/namei.c:4398 [inline] open_last_lookups fs/namei.c:4583 [inline] path_openat+0x135f/0x64c0 fs/namei.c:4827 do_file_open+0x2aa/0x680 fs/namei.c:4859 [...] =============

AnalysisAI

Uninitialized memory read in the Linux kernel FUSE filesystem driver causes local denial-of-service conditions. Specifically, fuse_dentry_revalidate() in fs/fuse/dir.c reads the ->d_time field of a dentry that was allocated by __d_alloc() without initialization, detectable by KMSAN as a use-before-initialize defect. A local authenticated user with access to a FUSE-mounted filesystem can trigger a kernel crash by opening a file through the affected lookup_open → d_revalidate code path. No public exploit exists and EPSS is 0.15%, indicating minimal real-world exploitation pressure at this time.

Technical ContextAI

FUSE (Filesystem in Userspace) is a Linux kernel subsystem that allows non-privileged processes to implement filesystems in userspace. The vulnerable function fuse_dentry_revalidate() (fs/fuse/dir.c:394) is called via the VFS layer's d_revalidate hook to determine whether a cached directory entry (dentry) remains valid. When lookup_open() allocates a fresh dentry via __d_alloc() and immediately invokes d_revalidate(), the dentry's ->d_time field has never been set - it contains raw uninitialized slab memory. CWE-908 (Use of Uninitialized Resource) captures this root cause exactly: the kernel reads a timing value from uninitialized heap memory, which can lead to unpredictable behavior including kernel panics. The CPE string cpe:2.3:a:linux:linux:* spans a commit range starting from 2396356a945bb022aff02656f59c2a45d457043f. The affected stable branches include Linux 6.16 and pre-fix states of 7.0.x and 6.18.x series.

RemediationAI

The primary fix is to update to a patched Linux kernel version: 7.0.10 or later in the 7.0.x series, 6.18.34 or later in the 6.18.x series, or 7.1 and later. The fix commits are available at https://git.kernel.org/stable/c/da3d241c5b925f17a9d8051d7a9e0d454d8e01f6, https://git.kernel.org/stable/c/3ac9117ba3deab8a5dd22847355f861686f4bee7, and https://git.kernel.org/stable/c/5a6baf204610589f8a5b5a1cd69d1fe661d9d3cd; distribution maintainers should backport the relevant stable commit. As a compensating control where patching is not immediately possible, restricting unprivileged users from mounting FUSE filesystems (e.g., setting user_allow_other to off in /etc/fuse.conf, or restricting fusermount via capability controls or AppArmor/SELinux policy) will prevent untrusted local users from triggering the vulnerable code path. This control trades off legitimate FUSE functionality for reduced attack surface.

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53311 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy