In the Linux kernel, the function fuse_dentry_revalidate() may read an uninitialized element of a dentry structure. Because the d_time field can be stale or garbage when a dentry is freshly allocated, the kernel may process invalid data during directory entry validation. This uninitialized read can potentially leak internal kernel memory or trigger undefined kernel behavior, such as a crash, which may jeopardize system stability or allow secret data disclosure. The description does not indicate that the flaw directly permits code execution, but information leakage and destabilization can be significant in a privileged environment.

Any Linux kernel distribution running a version that does not incorporate the recent fix will be affected. The corresponding commit identifiers are 3ac9117ba3deab8a5dd22847355f861686f4bee7, 5a6baf204610589f8a5b5a1cd69d1fe661d9d3cd, and da3d241c5b925f17a9d8051d7a9e0d454d8e01f6, which are present in the upstream kernel's latest stable releases. Users should consult their distribution’s kernel changelog to determine whether the fix is included early in their release cycle.

The CVSS score is 5.5 and the EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability requires that the attacker can trigger fuse_dentry_revalidate, which occurs during normal FUSE filesystem operations such as opening a path. Therefore the risk vector is local or limited to users who can mount or access a FUSE filesystem. An attacker with sufficient local privileges could exploit the flaw to read kernel memory or force a fault, but the mechanism does not appear to enable remote code execution directly. The likelihood of exploitation remains uncertain until a demonstrable exploit emerges.