Linux Kernel FUSE NULL Pointer Dereference DoS in fuse_get_tree_submount

Vulnerability Key Information Summary Vulnerability Overview Type: NULL pointer dereference Location: The function in Trigger Condition: Under memory pressure, the allocation of the root inode for auto-submount fails, causing to return NULL. Subsequent code dereferences the pointer without checking, leading to a kernel crash (oops) Impact: Kernel Oops, system downtime Affected Scope Affected Versions: Linux kernel 6.6 and earlier (commit mentions ) Trigger Scenario: Memory pressure + auto-submount failure Fix Details Fix Commit: Fix Description: Adds a NULL check for the return value of within the function. If NULL, it returns to prevent NULL pointer dereference Fix Code: ```c root = fuse_get_tree_submount(struct super_block sb, fuse_fill_super_submount(struct super_block sb, void arg, void data, void data2, void data3, void data4, void data5, void data6, void data7, void data8, void data9, void data10, void data11, void data12, void data13, void data14, void data15, void data16, void data17, void data18, void data19, void data20, void data21, void data22, void data23, void data24, void data25, void data26, void data27, void data28, void data29, void data30, void data31, void data32, void data33, void data34, void data35, void data36, void data37, void data38, void data39, void data40, void data41, void data42, void data43, void data44, void data45, void data46, void data47, void data48, void data49, void data50, void data51, void data52, void data53, void data54, void data55, void data56, void data57, void data58, void data59, void data60, void data61, void data62, void data63, void data64, void data65, void data66, void data67, void data68, void data69, void data70, void data71, void data72, void data73, void data74, void data75, void data76, void data77, void data78, void data79, void data80, void data81, void data82, void data83, void data84, void data85, void data86, void data87, void data88, void data89, void data90, void data91, void data92, void data93, void data94, void data95, void data96, void data97, void data98, void data99, void data100, void data101, void data102, void data103, void data104, void data105, void data106, void data107, void data108, void data109, void data110, void data111, void data112, void data113, void data114, void data115, void data116, void data117, void data118, void data119, void data120, void data121, void data122, void data123, void data124, void data125, void data126, void data127, void data128, void data129, void data130, void data131, void data132, void data133, void data134, void data135, void data136, void data137, void data138, void data139, void data140, void data141, void data142, void data143, void data144, void data145, void data146, void data147, void data148, void data149, void data150, void data151, void data152, void data153, void data154, void data155, void data156, void data157, void data158, void data159, void data160, void data161, void data162, void data163, void data164, void data165, void data166, void data167, void data168, void data169, void data170, void data171, void data172, void data173, void data174, void data175, void data176, void data177, void data178, void data179, void data180, void data181, void data182, void data183, void data184, void data185, void data186, void data187, void data188, void data189, void data190, void data191, void data192, void data193, void data194, void data195, void data196, void data197, void data198, void data199, void data200, void data201, void data202, void data203, void data204, void data205, void data206, void data207, void data208, void data209, void data210, void data211, void data212, void data213, void data214, void data215, void data216, void data217, void data218, void data219, void data220, void data221, void data222, void data223, void data224, void data225, void data226, void data227, void data228, void data229, void data230, void data231, void data232, void data233, void data234, void data235, void data236, void data237, void data238, void data239, void data240, void data241, void data242, void data243, void data244, void data245, void data246, void data247, void data248, void data249, void data250, void data251, void data252, void data253, void data254, void data255, void data256, void data257, void data258, void data259, void data260, void data261, void data262, void data263, void data264, void data265, void data266, void data267, void data268, void data269, void data270, void data271, void data272, void data273, void data274, void data275, void data276, void data277, void data278, void data279, void data280, void data281, void data282, void data283, void data284, void data285, void data286, void data287, void data288, void data289, void data290, void data291, void data292, void data293, void data294, void data295, void data296, void data297, void data298, void data299, void data300, void data301, void data302, void data303, void data304, void data305, void data306, void data307, void data308,

Goal Reached Thanks to every supporter — we hit 100%!

Linux Kernel FUSE NULL Pointer Dereference DoS in fuse_get_tree_submount