Post

RingWraith: Summary

Press summary for RingWraith — CVE-2026-33150 and CVE-2026-33179 in libfuse io_uring.

Two memory safety CVEs in libfuse’s brand-new io_uring transport, triggered by standard container security hardening.


A use-after-free and a NULL pointer dereference in libfuse’s io_uring integration — the reference FUSE userspace library for Linux — were discovered and fixed in March 2026. The bugs were present in libfuse 3.18.0 and 3.18.1, the only two releases with io_uring support before the fix. The attack surface will grow as distributions adopt libfuse 3.18+.

The impact: A FUSE daemon using io_uring can crash during shutdown — or worse, operate on freed memory that may have been overwritten, opening the door to potential code execution. The bug is triggered when container resource limits (a standard security practice) cause io_uring startup to fail. The error handler frees memory but keeps a stale pointer, which is later dereferenced. See the full technical writeup for root cause analysis, exploitation surface, and PoC.

Why io_uring matters here: Google disclosed that 60% of kernel exploit submissions to their kCTF VRP targeted io_uring. They disabled it on ChromeOS and production servers, and restricted it on Android via seccomp-bpf. libfuse’s first io_uring release shipped with a UAF in the startup error path.

libfuse has had only 9 CVEs in its first ~24 years (2001–2025) — an 8-year gap before these two. The io_uring integration broke that streak on its first release.


 CVE-2026-33150CVE-2026-33179
TypeUse-After-FreeNULL Deref + Memory Leak
CVSS7.8 HIGH5.5 MEDIUM
ImpactCrash (DoS), theoretical code execution via heap reuseCrash (DoS via NULL deref), filesystem hang (via error swallowed as success)
Affectedlibfuse 3.18.0 – 3.18.1libfuse 3.18.0 – 3.18.1
Fixed inlibfuse 3.18.2libfuse 3.18.2

Reporter: Abhinav Agarwal, Sr. Software Developer at Rubrik


Contact

Abhinav Agarwal · abhinav [dot] agarwal [at] rubrik [dot] com · GitHub

This post is licensed under CC BY 4.0 by the author.