{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  fuse: check for NULL root inode in fuse_fill_super_submount  fuse_iget() can return NULL when its inode allocation fails, but fuse_fill_super_submount() passed the result straight to get_fuse_inode() and decremented fi-\u003enlookup without checking it:          root = fuse_iget(sb, parent_fi-\u003enodeid, ...);         fi = get_fuse_inode(root);         fi-\u003enlookup--;  Inside fuse_iget() the inode allocation can fail and return NULL.  The submount root takes the iget5_locked() path, whose alloc_inode() can fail under memory pressure (the auto-submount branch can fail the same way in new_inode() or fuse_alloc_submount_lookup()):          inode = iget5_locked(sb, nodeid, fuse_inode_eq, fuse_inode_set,                              \u0026nodeid);         if (!inode)                 return NULL;  A NULL root makes get_fuse_inode() a container_of() on NULL and the nlookup decrement a write to a bogus address, oopsing the mount.  With CONFIG_KASAN the following null pointer dereference is reported when the root inode allocation of an auto-submount fails (e.g. under memory pressure):  ================================================================== BUG: KASAN: null-ptr-deref in fuse_get_tree_submount+0x656/0x8b0 Read of size 8 at addr 00000000000002b0 by task ls/942 CPU: 0 PID: 942 Comm: ls Tainted: G W 6.6 #15 Call Trace:  \u003cTASK\u003e  fuse_get_tree_submount+0x656/0x8b0  vfs_get_tree+0x48/0x140  fc_mount+0x13/0x50  fuse_dentry_automount+0x7a/0xb0  __traverse_mounts+0xca/0x330  step_into+0x339/0xac0  path_lookupat+0xc5/0x2f0  filename_lookup+0x163/0x2a0  vfs_statx+0xd5/0x200  do_statx+0x83/0xd0  __x64_sys_statx+0xa0/0xc0  do_syscall_64+0x37/0x90  entry_SYSCALL_64_after_hwframe+0x78/0xe2  \u003c/TASK\u003e ==================================================================  Return -ENOMEM instead; the caller tears down the partially built superblock on error, matching the other error returns in this function.",
  "id": "DEBIAN-CVE-2026-90139",
  "modified": "2026-09-18T04:47:26.470925897Z",
  "published": "2026-09-17T17:17:06.523Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-90139"
    }
  ],
  "upstream": [
    "CVE-2026-90139"
  ]
}