CVE-2026-53168: Linux Kernel FUSE Cache Injection Vulnerability – Denial of Service Risk

Technical summary

The FUSE subsystem in the Linux kernel permits two notification opcodes—FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE—that enable a FUSE daemon to directly read or write pagecache contents from userspace. When directories are opened with the FOPEN_CACHE_DIR flag, their pagecache serves as an opaque kernel-internal cache managed by fuse_parse_cache(). The kernel assumes this cache contains only valid, kernel-generated data; the fuse_parse_cache() function includes WARN_ON() assertions that fire if bogus entries are detected. Prior to this fix, the kernel did not validate that FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE operations target only regular files. A local FUSE daemon (or process capable of communicating with the FUSE kernel interface) could send these operations targeting directories, corrupting the internal cache and triggering warnings or instability. The remediation adds explicit type checking to reject these operations on non-regular-file inodes, returning -EINVAL.

Business impact

For organizations deploying containerized workloads, serverless computing, or virtualized environments that rely on FUSE-based filesystems (OverlayFS, unionfs, or proprietary FUSE implementations), a malicious or compromised FUSE daemon could exploit this vulnerability to destabilize the kernel, cause denial of service, or trigger unexpected behavior in file operations. This is particularly concerning in multi-tenant environments where isolation between guest FUSE daemons is critical. While the vulnerability requires local access and FUSE daemon privileges, the impact on system stability and the breadth of FUSE adoption across container and cloud platforms makes patching important for infrastructure stability.

Affected systems

All versions of the Linux kernel incorporating the vulnerable FUSE implementation are affected. The vulnerability exists in any kernel where FUSE support is compiled and enabled, regardless of architecture. Systems running containerized workloads, Kubernetes nodes, or other platforms using FUSE-based overlay filesystems are at elevated practical risk. Desktop and server systems where untrusted FUSE daemons or user-space filesystem implementations are deployed are also in scope.

Exploitability

Exploitation requires local access and the ability to operate a FUSE daemon or send FUSE protocol messages to the kernel. An unprivileged user who can launch a FUSE mount point can trigger this vulnerability. The barrier to exploitation is low—no special privileges or complex techniques are needed beyond basic FUSE protocol knowledge. However, practical impact depends on the target's reliance on FUSE and whether directory caching is actively used. The vulnerability is not exploitable remotely and does not grant privilege escalation on its own, but it can disrupt system availability.

Remediation

Apply the Linux kernel patch that adds validation to reject FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE operations when the target inode is not a regular file, returning -EINVAL in such cases. Verify the patch version against the vendor advisory to confirm it is included in your kernel release. For distributions, monitor for and apply security updates as they become available. In the interim, restrict FUSE mount permissions to trusted users and monitor system logs for unexpected FUSE errors or cache-related warnings.

Patch guidance

Consult your Linux distribution's security advisory for the specific kernel version that includes the fix for CVE-2026-53168. The patch is a defensive check added to the FUSE notification handler; verify that your kernel build includes this validation. For custom or embedded kernels, backport the upstream fix or upgrade to a kernel version that includes it. Test patched kernels in staging environments to ensure compatibility with existing FUSE-dependent workloads before production deployment.

Detection guidance

Monitor kernel logs for WARN_ON() messages from fuse_parse_cache() or related FUSE subsystem warnings, which may indicate attempted exploitation. Audit FUSE mount creation and permission grants, especially for untrusted or dynamically spawned FUSE daemons. Use strace or eBPF-based tracing to observe FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE operations targeting directory inodes. Implement container runtime policies that restrict FUSE capabilities to only necessary workloads and verify daemon integrity before permitting mounts.

Why prioritize this

This vulnerability merits prompt attention because FUSE is ubiquitous in container and cloud infrastructure, and denial-of-service attacks on the kernel can cascade into application outages. Although exploit complexity is low and privilege requirements moderate, the widespread use of overlay filesystems and the sensitivity of kernel stability make this a medium-priority fix for environments where uptime and availability are critical. Organizations running Kubernetes, Docker, or similar systems should prioritize patching.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects local-only access requirements, low attack complexity, and absence of privilege escalation or confidentiality impact. The score is driven by high availability impact: successful exploitation can cause denial of service or system instability. The lack of remote exploitability and the requirement for FUSE daemon capability prevent a higher score, but the kernel-level stability risk and prevalence of FUSE in modern infrastructure justify treating this as a priority fix rather than a low-risk issue.

Frequently asked questions