CVE-2026-53167: fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios

highCVSS 7CVE-2026-53167

CSIRTS triage

Other

What: The vulnerability limits FUSE_NOTIFY_RETRIEVE to up-to-date folios.
Who is affected: Deployments using FUSE may be affected.
Urgency: Remediation is high urgency due to the high severity rating.
Action: Apply the latest patches for FUSE.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source: Microsoft Security Response Center (INTL · vendor-psirt · site)
Severity: high — CVSS 7
Published: 2026-06-09
Exploitation: Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53167

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-531670.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-53167	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownDebian Linux Kernel Multiple Vulnerabilitieshkcert
unknownMultiple vulnerabilities in Debian LTS Linux kernel (July 31, 2026)cert-fr-avis
unknownMultiple vulnerabilities in Debian LTS Linux kernel (July 24, 2026)cert-fr-avis
unknownDSA-6381-1 linux - security updatedebian

Recent advisories for fuse

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-68095: In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race betwe…nvd · 2026-08-10
high[UPDATE] [high] Red Hat FUSE: Multiple vulnerabilitiescert-bund · 2026-08-10
highCVE-2026-64588: In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix data races…nvd · 2026-08-06
highCVE-2026-64266: fuse: re-lock request before returning from fuse_ref_folio()msrc · 2026-08-06
unknownCVE-2026-52791: fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.1…nvd · 2026-07-29
unknownCVE-2026-64267: In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune n…nvd · 2026-07-25