Linux Kernel up to 6.18.24/7.0.1 fuse FUSE_INIT denial of service

Summaryinfo

A vulnerability has been found in Linux Kernel up to 6.18.24/7.0.1 and classified as critical. Affected is the function FUSE_INIT of the component fuse. This manipulation causes denial of service. This vulnerability is handled as CVE-2026-31713. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.18.24/7.0.1. It has been declared as critical. Affected by this vulnerability is the function FUSE_INIT of the component fuse. The manipulation with an unknown input leads to a denial of service vulnerability. The CWE definition for the vulnerability is CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. As an impact it is known to affect availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: fuse: abort on fatal signal during sync init When sync init is used and the server exits for some reason (error, crash) while processing FUSE_INIT, the filesystem creation will hang. The reason is that while all other threads will exit, the mounting thread (or process) will keep the device fd open, which will prevent an abort from happening. This is a regression from the async mount case, where the mount was done first, and the FUSE_INIT processing afterwards, in which case there's no such recursive syscall keeping the fd open.

The advisory is shared at git.kernel.org. This vulnerability is known as CVE-2026-31713 since 03/09/2026. Technical details are known, but no exploit is available.

Upgrading to version 6.18.25, 7.0.2 or 7.1-rc1 eliminates this vulnerability. Applying the patch 0c7fca880a40a209a9c92be14143996d14b93ff6/300e812b882a174dca675d8028684001ad5826bc/204aa22a686bfee48daca7db620c1e017615f2ff is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1346). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Google Container-Optimized OS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• Open Source Linux Kernel
• RESF Rocky Linux
• Microsoft Azure Linux
• Red Hat OpenShift

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.18.13
• 6.18.14
• 6.18.15
• 6.18.16
• 6.18.17
• 6.18.18
• 6.18.19
• 6.18.20
• 6.18.21
• 6.18.22
• 6.18.23
• 6.18.24
• 7.0.0
• 7.0.1

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion