CVE-2026-90139

In the Linux kernel, the following vulnerability has been resolved:

fuse: check for NULL root inode in fuse_fill_super_submount

fuse_iget() can return NULL when its inode allocation fails, but

fuse_fill_super_submount() passed the result straight to get_fuse_inode()

and decremented fi->nlookup without checking it:

root = fuse_iget(sb, parent_fi->nodeid, ...);

fi = get_fuse_inode(root);

fi->nlookup--;

Inside fuse_iget() the inode allocation can fail and return NULL. The

submount root takes the iget5_locked() path, whose alloc_inode() can fail

under memory pressure (the auto-submount branch can fail the same way in

new_inode() or fuse_alloc_submount_lookup()):

inode = iget5_locked(sb, nodeid, fuse_inode_eq, fuse_inode_set,

&nodeid);

if (!inode)

return NULL;

A NULL root makes get_fuse_inode() a container_of() on NULL and the

nlookup decrement a write to a bogus address, oopsing the mount. With

CONFIG_KASAN the following null pointer dereference is reported when the

root inode allocation of an auto-submount fails (e.g. under memory

pressure):

==================================================================

BUG: KASAN: null-ptr-deref in fuse_get_tree_submount+0x656/0x8b0

Read of size 8 at addr 00000000000002b0 by task ls/942

CPU: 0 PID: 942 Comm: ls Tainted: G W 6.6 #15

Call Trace:

<TASK>

fuse_get_tree_submount+0x656/0x8b0

vfs_get_tree+0x48/0x140

fc_mount+0x13/0x50

fuse_dentry_automount+0x7a/0xb0

__traverse_mounts+0xca/0x330

step_into+0x339/0xac0

path_lookupat+0xc5/0x2f0

filename_lookup+0x163/0x2a0

vfs_statx+0xd5/0x200

do_statx+0x83/0xd0

__x64_sys_statx+0xa0/0xc0

do_syscall_64+0x37/0x90

entry_SYSCALL_64_after_hwframe+0x78/0xe2

</TASK>

==================================================================

Return -ENOMEM instead; the caller tears down the partially built

superblock on error, matching the other error returns in this

function.