libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a NULL pointer dereference and memory leak in fuse_uring_init_queue allows a local user to crash the FUSE daemon or cause resource exhaustion. When numa_alloc_local fails during io_uring queue entry setup, the code proceeds with NULL pointers. When fuse_uring_register_queue fails, NUMA allocations are leaked and the function incorrectly returns success. Only the io_uring transport is affected; the traditional /dev/fuse path is not affected. PoC confirmed with AddressSanitizer/LeakSanitizer. This issue has been patched in version 3.18.2.

An update of the fuse3 package has been released.

The remote host is affected by the vulnerability described in GLSA-202604-03 (FUSE: Multiple Vulnerabilities)

    The following vulnerabilities have been discovered in FUSE: a NULL pointer dereference (when running with     the NUMA architecture) and a use-after-free. The worst of which can lead to code execution. Please review     the CVE identifiers referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a     NULL pointer dereference and memory leak in fuse_uring_init_queue allows a local user to crash the FUSE     daemon or cause resource exhaustion. When numa_alloc_local fails during io_uring queue entry setup, the     code proceeds with NULL pointers. When fuse_uring_register_queue fails, NUMA allocations are leaked and     the function incorrectly returns success. Only the io_uring transport is affected; the traditional     /dev/fuse path is not affected. PoC confirmed with AddressSanitizer/LeakSanitizer. This issue has been     patched in version 3.18.2. (CVE-2026-33179)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
332349	Photon OS 5.0: Fuse3 PHSA-2026-5.0-91-0860	Nessus	PhotonOS Local Security Checks	Local	medium
322366	Photon OS 5.0: Fuse3 PHSA-2026-5.0-0860	Nessus	PhotonOS Local Security Checks	Local	medium
307394	GLSA-202604-03 : FUSE: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
303266	Linux Distros Unpatched Vulnerability : CVE-2026-33179	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-33179

medium

Tenable Plugins

medium

medium

high

medium