CVE-2026-31713

Root

Cause

The vulnerability lies in the Linux kernel's FUSE (Filesystem in Userspace) implementation during synchronous initialization. When sync init is used, the mounting thread sends a FUSE_INIT request to the server and waits for a response. If the server exits (due to an error or crash) while processing this request, the filesystem creation hangs indefinitely. This happens because the mounting thread keeps the device file descriptor open, which in turn prevents an abort mechanism from triggering and terminating the stalled operation [1].

Attack

Surface and Exploitation

The issue is a regression from the async mount case, where the mount operation completes first, and FUSE_INIT processing occurs later without holding the fd open in a recursive syscall. In the sync init scenario, a local or remote attacker who can cause the FUSE server to crash or exit unexpectedly can exploit this to create a denial-of-service condition on the mounting system. No special privileges beyond the ability to trigger a FUSE mount (typically requiring root or user with fuse group membership) are required [1].

Impact

If exploited, the system will experience a hang during FUSE filesystem creation, effectively denying service for any further operations that depend on that mount point. The affected process (mounting thread) becomes unkillable, potentially leading to resource exhaustion or system instability. The vulnerability has a CVSS v3 score of 5.5 (Medium), indicating a moderate availability impact [1].

Mitigation

The fix is included in stable kernel updates. Users should apply the latest kernel patches that incorporate commit 0c7fca880a40 (among others). Systems using FUSE with sync init (e.g., certain filesystem fuse implementations) are at risk and should be updated promptly [1].