The Linux kernel’s FUSE subsystem contains a flaw that can cause a mounting operation to hang when the FUSE server process exits or crashes during synchronous initialization. During sync init, the mounting thread keeps the device file descriptor open, preventing the kernel from aborting the mount and leaving the filesystem creation stalled. The effect is a resource exhaustion condition that blocks further operations on the affected filesystem, thereby denying availability to any service that relies on it. This weakness is a form of improper resource management (CWE-911).

All Linux kernels that include the FUSE driver and perform synchronous mounts are subject to this issue. No specific kernel version is cited in the advisories, so every release prior to the patch is potentially vulnerable. Systems that deploy custom or older kernels and use synchronous FUSE mounts are at particular risk, regardless of distribution. The bug applies to any scenario where sync init is enabled for a FUSE mount.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is unavailable while the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker who can cause the FUSE server to receive a fatal signal—such as by sending a kill command or exploiting a crash in the server code—can trigger the hang. The likely attack vector is local or remote access to the server process. Because the condition requires a server crash during sync init and no public exploitation is documented, the likelihood of exploitation is moderate and requires monitoring of vulnerable environments.