CVE-2026-58829

Summary

A use-after-free vulnerability in fuse_backing_mmap() allows an unprivileged local attacker to corrupt memory after the underlying object has been freed, potentially leading to privilege escalation without user interaction.

Exploitability

Exploitation requires local access and no privileges; the lack of user interaction and low attack complexity (AV:L/AC:L/PR:N) makes it highly exploitable by a local attacker.

Blast radius

Successful exploitation could grant an unprivileged local user full system compromise (C:H/I:H/A:H), enabling complete control over the affected host.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to FUSE version 2.590 or later, as this release includes the fix for CVE-2026-58829.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.