CVE-2026-53167: Linux Kernel FUSE Memory Disclosure Vulnerability (CVSS 5.5)

Technical summary

The FUSE_NOTIFY_RETRIEVE mechanism is designed to efficiently retrieve cached data without blocking on the FUSE daemon. However, the code did not properly validate that retrieved folios (kernel page cache units) were marked as 'uptodate' before returning their contents. When a folio is not uptodate, it may contain uninitialized or stale data. A local process interacting with a FUSE filesystem could trigger retrieval of such folios, allowing read access to uninitialized kernel memory. The fix restricts FUSE_NOTIFY_RETRIEVE to only return data from uptodate folios, treating non-uptodate folios as if they are not present in the cache.

Business impact

This vulnerability is classified as information disclosure with a MEDIUM severity rating. The practical risk depends heavily on kernel configuration: systems with CONFIG_INIT_ON_ALLOC_DEFAULT_ON enabled or the init_on_alloc=1 boot parameter are protected by automatic memory zeroing. Unprotected systems face potential exposure of sensitive kernel state to unprivileged local attackers, though exploitation requires active interaction with a FUSE filesystem. The impact is localized to individual systems—it does not affect cross-system compromise or remote exploitation. Organizations running standard, up-to-date Linux distributions (which typically enable memory initialization) face lower risk than those running minimal or custom kernel configurations.

Affected systems

All versions of the Linux kernel are potentially affected. The vulnerability is most relevant to systems running FUSE filesystems (such as those using SSHFS, encfs, or user-space network filesystems) on kernels without memory initialization enabled. Embedded systems, custom minimal kernels, or older distributions that do not enable CONFIG_INIT_ON_ALLOC_DEFAULT_ON by default are at higher risk. Standard production distributions (Red Hat, Debian, Ubuntu, SUSE) typically have memory initialization enabled, which mitigates the issue.

Exploitability

Exploitation requires local access and interaction with an active FUSE filesystem. A local unprivileged user cannot exploit this remotely. The attack surface is limited to systems where FUSE filesystems are mounted and accessible to the attacker. This vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no active public exploitation has been reported as of the last update. The barrier to exploitation is moderate—an attacker must have system access and familiarity with FUSE internals, but no exotic kernel exploitation techniques are required.

Remediation

Apply kernel patches that restrict FUSE_NOTIFY_RETRIEVE to uptodate folios. Verify with your distribution for backported patches to supported kernel versions. In the interim, mitigate risk by ensuring memory initialization is enabled via kernel parameters or configuration. Check your running kernel: if init_on_alloc is already active, the practical risk is substantially reduced.

Patch guidance

Monitor your Linux distribution's security advisories for kernel updates addressing CVE-2026-53167. Verify patch availability from your vendor (Red Hat, Debian, Ubuntu, SUSE, etc.) and apply according to your normal update cycle. This is a local-only vulnerability, so patches can be scheduled during standard maintenance windows rather than as emergency out-of-cycle releases. Test patches in non-production environments before rollout to confirm stability with your FUSE workloads.

Detection guidance

Detection of exploitation attempts is challenging without kernel instrumentation. Kernel log analysis may reveal unusual FUSE_NOTIFY_RETRIEVE activity, but FUSE operations are not logged by default. Consider enabling audit logging on FUSE filesystem operations if you maintain high-security environments. Monitor for suspicious memory access patterns in applications accessing FUSE filesystems. The most practical detection is confirming patch application and kernel configuration state (init_on_alloc status) across your infrastructure.

Why prioritize this

Although classified MEDIUM severity, prioritize this vulnerability based on your environment's memory initialization configuration and FUSE filesystem deployment. Systems with init_on_alloc enabled can defer patching to standard maintenance cycles. Systems without memory initialization and running user-facing FUSE filesystems should prioritize patches more urgently. The local-only attack vector and lack of active exploitation lower the emergency tier compared to remote code execution vulnerabilities.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects: local attack vector (AV:L) and low attack complexity (AC:L), requiring privilege (PR:L) but no user interaction (UI:N). The availability impact (A:H) scores high because uninitialized memory disclosure could cause denial of service if leveraged to corrupt application state, though primary impact is confidentiality. The score appropriately reflects that exploitation is restricted to local attackers but carries meaningful information disclosure risk on unprotected systems.

Frequently asked questions