CVE-2026-90139

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fuse: check for NULL root inode in fuse_fill_super_submount

fuse_iget() can return NULL when its inode allocation fails, but

fuse_fill_super_submount() passed the result straight to get_fuse_inode()

and decremented fi->nlookup without checking it:

root = fuse_iget(sb, parent_fi->nodeid, ...);

fi = get_fuse_inode(root);

fi->nlookup--;

Inside fuse_iget() the inode allocation can fail and return NULL. The

submount root takes the iget5_locked() path, whose alloc_inode() can fail

under memory pressure (the auto-submount branch can fail the same way in

new_inode() or fuse_alloc_submount_lookup()):

inode = iget5_locked(sb, nodeid, fuse_inode_eq, fuse_inode_set,

&nodeid);

if (!inode)

return NULL;

A NULL root makes get_fuse_inode() a container_of() on NULL and the

nlookup decrement a write to a bogus address, oopsing the mount. With

CON

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References