CVE-2026-53167

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the fuse module where FUSE NOTIFY RETRIEVE is not limited to uptodate folios. Because FUSE NOTIFY RETRIEVE is designed to return data already present in the page cache without waiting for the FUSE daemon, folios that are not uptodate may contain uninitialized data. This creates a security risk on systems that do not enable automatic zero-initialization of all page allocations via CONFIG INIT ON ALLOC DEFAULT ON or init on alloc=1.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Enable automatic zero-initialization of all page allocations via CONFIG INIT ON ALLOC DEFAULT ON or init on alloc=1 to mitigate the risk of exposing uninitialized data.