CVE-2026-53311

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fuse: fix uninit-value in fuse_dentry_revalidate()

fuse_dentry_revalidate() may be called with a dentry that didn't had

->d_time initialised. The issue was found with KMSAN, where lookup_open()

calls __d_alloc(), followed by d_revalidate(), as shown below:

=====================================================

BUG: KMSAN: uninit-value in fuse_dentry_revalidate+0x150/0x13d0 fs/fuse/dir.c:394

fuse_dentry_revalidate+0x150/0x13d0 fs/fuse/dir.c:394

d_revalidate fs/namei.c:1030 [inline]

lookup_open fs/namei.c:4405 [inline]

open_last_lookups fs/namei.c:4583 [inline]

path_openat+0x1614/0x64c0 fs/namei.c:4827

do_file_open+0x2aa/0x680 fs/namei.c:4859

[...]

Uninit was created at:

slab_post_alloc_hook mm/slub.c:4466 [inline]

slab_alloc_node mm/slub.c:4788 [inline]

kmem_cache_alloc_lru_noprof+0x382/0x1280 mm/slub.c:4807

__d_alloc+0x55/0xa00 fs/dcache.c:1740

d_alloc_parallel+0x99/0x2740 fs/dcache.c:2604

lookup_open f

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References