Linux Kernel EUVD-2026-39259

FUSE (Filesystem in Userspace) is a Linux kernel subsystem enabling userspace-implemented filesystems via a daemon protocol. Two FUSE notification operations - FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE - allow the FUSE daemon to directly write to and read from the kernel's pagecache on behalf of regular files, a legitimate optimization for file data. A separate capability, FOPEN_CACHE_DIR, repurposes the pagecache as an opaque kernel-internal cache for directory entries, and this cache is not designed for direct userspace manipulation. The root cause is an absent input validation check in the fuse_notify() handler: it did not enforce that FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE operations are restricted to regular file inodes. When these operations target a directory inode operating under FOPEN_CACHE_DIR, the kernel's fuse_parse_cache() function processes the resulting bogus cache contents and fires a WARN_ON() assertion, which on most production kernel configurations causes a kernel panic. CWE is not formally assigned in the provided data, but the pattern aligns with improper input validation (CWE-20) - specifically, a missing inode type check. Affected products per CPE: cpe:2.3:o:linux:linux_kernel across multiple stable branches through 7.1-rc3.