A use‑after‑free flaw exists in libfuse’s io_uring subsystem. When thread creation fails, the ring pool structure is freed while a dangling pointer remains in session state. During cleanup this pointer is dereferenced, allowing a local attacker to crash the filesystem process or, if they control memory, execute arbitrary code. The issue maps to CWE‑416 (Use After Free) and CWE‑825 (Use of Uninitialized Variable).

The vulnerability affects libfuse versions from 3.18.0 up to, but not including, 3.18.2. All Linux systems running the default FUSE reference implementation and using io_uring for file system operations are impacted. The patch is available in libfuse 3.18.2 and later.

The CVSS base score is 7.8, indicating high severity. EPSS is below 1% and the vulnerability is not listed in the CISA KEV catalog, marking it as low probability of exploitation. The attack vector is local; exploitation requires an attacker with access to the host or a container running the vulnerable FUSE instance, especially in environments where cgroup pids.max limits thread creation. Successful exploitation can result in application crashes or arbitrary code execution with the privileges of the FUSE process.