CVE-2026-53311: fuse: fix uninit-value in fuse_dentry_revalidate()
In the Linux kernel, the following vulnerability has been resolved:
fuse: fix uninit-value in fusedentryrevalidate()
fusedentryrevalidate() may be called with a dentry that didn't had ->dtime initialised. The issue was found with KMSAN, where lookupopen() calls dalloc(), followed by drevalidate(), as shown below:
===================================================== BUG: KMSAN: uninit-value in fusedentryrevalidate+0x150/0x13d0 fs/fuse/dir.c:394 fusedentryrevalidate+0x150/0x13d0 fs/fuse/dir.c:394 drevalidate fs/namei.c:1030 [inline] lookupopen fs/namei.c:4405 [inline] openlastlookups fs/namei.c:4583 [inline] pathopenat+0x1614/0x64c0 fs/namei.c:4827 dofileopen+0x2aa/0x680 fs/namei.c:4859 [...]
Uninit was created at: slabpostallochook mm/slub.c:4466 [inline] slaballocnode mm/slub.c:4788 [inline] kmemcachealloclrunoprof+0x382/0x1280 mm/slub.c:4807 dalloc+0x55/0xa00 fs/dcache.c:1740 dallocparallel+0x99/0x2740 fs/dcache.c:2604 lookupopen fs/namei.c:4398 [inline] openlastlookups fs/namei.c:4583 [inline] pathopenat+0x135f/0x64c0 fs/namei.c:4827 dofileopen+0x2aa/0x680 fs/namei.c:4859 [...] =====================================================
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53311?
CVE-2026-53311 has a risk rating of 11, indicating a critical severity level.
How do I fix CVE-2026-53311?
To fix CVE-2026-53311, update the Linux kernel to the latest patched version.
What systems are affected by CVE-2026-53311?
CVE-2026-53311 affects all versions of the Linux kernel prior to the fix implementation.
What type of vulnerability is CVE-2026-53311?
CVE-2026-53311 is an uninitialized memory access vulnerability in the Linux kernel.
What impact does CVE-2026-53311 have on system security?
CVE-2026-53311 could potentially allow attackers to exploit uninitialized values, leading to unpredictable behavior or system crashes.