CVE-2026-90139: fuse: check for NULL root inode in fuse_fill_super_submount

In the Linux kernel, the following vulnerability has been resolved:

fuse: check for NULL root inode in fusefillsupersubmount

fuseiget() can return NULL when its inode allocation fails, but fusefillsupersubmount() passed the result straight to getfuseinode() and decremented fi->nlookup without checking it:

root = fuseiget(sb, parentfi->nodeid, ...); fi = getfuseinode(root); fi->nlookup--;

Inside fuseiget() the inode allocation can fail and return NULL. The submount root takes the iget5locked() path, whose allocinode() can fail under memory pressure (the auto-submount branch can fail the same way in newinode() or fuseallocsubmountlookup()):

inode = iget5locked(sb, nodeid, fuseinodeeq, fuseinodeset, &nodeid); if (!inode) return NULL;

A NULL root makes getfuseinode() a containerof() on NULL and the nlookup decrement a write to a bogus address, oopsing the mount. With CONFIGKASAN the following null pointer dereference is reported when the root inode allocation of an auto-submount fails (e.g. under memory pressure):

================================================================== BUG: KASAN: null-ptr-deref in fusegettreesubmount+0x656/0x8b0 Read of size 8 at addr 00000000000002b0 by task ls/942 CPU: 0 PID: 942 Comm: ls Tainted: G W 6.6 #15 Call Trace: <TASK> fusegettreesubmount+0x656/0x8b0 vfsgettree+0x48/0x140 fcmount+0x13/0x50 fusedentryautomount+0x7a/0xb0 traversemounts+0xca/0x330 stepinto+0x339/0xac0 pathlookupat+0xc5/0x2f0 filenamelookup+0x163/0x2a0 vfsstatx+0xd5/0x200 dostatx+0x83/0xd0 x64sysstatx+0xa0/0xc0 dosyscall64+0x37/0x90 entrySYSCALL64afterhwframe+0x78/0xe2 </TASK> ==================================================================

Return -ENOMEM instead; the caller tears down the partially built superblock on error, matching the other error returns in this function.