VulnerabilityPublished 25 Jun 2026Updated 6 Nov 2026

CVE-2026-53167: Linux kernel · fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in feafe8ccb1584254f59fbd4946d6ca7ef1e3e99c : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:49 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in feafe8ccb1584254f59fbd4946d6ca7ef1e3e99c, 651801d75ad0897dbd331b3cc6a4da3e78f60d42, 56763afa013444a9d84ca1b74e4b7130942177ba +5

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a, < feafe8ccb1584254f59fbd4946d6ca7ef1e3e99c	Fixed in feafe8ccb1584254f59fbd4946d6ca7ef1e3e99c
LinuxLinux	Affected ≥ 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a, < 651801d75ad0897dbd331b3cc6a4da3e78f60d42	Fixed in 651801d75ad0897dbd331b3cc6a4da3e78f60d42
LinuxLinux	Affected ≥ 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a, < 56763afa013444a9d84ca1b74e4b7130942177ba	Fixed in 56763afa013444a9d84ca1b74e4b7130942177ba
LinuxLinux	Affected ≥ 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a, < 68a9282d5ea5b8780d59122505ad633e6daede90	Fixed in 68a9282d5ea5b8780d59122505ad633e6daede90
LinuxLinux	Affected ≥ 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a, < 8bef2f840b43e0879478fe3aaa9ff2f0b80798a5	Fixed in 8bef2f840b43e0879478fe3aaa9ff2f0b80798a5
LinuxLinux	Affected ≥ 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a, < 4e14f29473eda18fb2af082dd2fd4c12139862cd	Fixed in 4e14f29473eda18fb2af082dd2fd4c12139862cd

Description

In the Linux kernel, the following vulnerability has been resolved: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios FUSE_NOTIFY_RETRIEVE must be limited to uptodate folios; !uptodate folios can contain uninitialized data. Since FUSE_NOTIFY_RETRIEVE is intended to only return data that is already in the page cache and not wait for data from the FUSE daemon, treat !uptodate folios as if they weren't present. This only has security impact on systems that don't enable automatic zero-initialization of all page allocations via CONFIG_INIT_ON_ALLOC_DEFAULT_ON or init_on_alloc=1.

References

Community reviews

Loading reviews…