Loading story…
A flaw in the Linux kernel FUSE subsystem, tracked as CVE-2026-31694, allows a local attacker to escalate privileges to root by exploiting how cached directory entries are handled during readdir operations. The bug is in fuse_add_dirent_to_cache(), where an attacker-controlled serialized FUSE directory entry can be copied into a single 4 KiB cache page without verifying that the entry itself fits, causing a 24-byte overflow and adjacent memory corruption on affected systems. Reports say a malicious FUSE server can trigger the issue through oversized filename data returned to the kernel.
Researchers demonstrated exploitation by corrupting cached bytes associated with a SUID binary such as /usr/bin/su, including a proof of concept that modified the cached .init page on Ubuntu 26.04 to execute code that calls setuid(0) and setgid(0) before spawning a root shell. The vulnerable logic was introduced in 2018, but practical exploitation reportedly became reachable with Linux v6.16-rc1 after a 2025 increase to the readdir buffer size. An upstream patch has been accepted to reject directory entries whose serialized size exceeds PAGE_SIZE before caching, while interim mitigations include limiting FUSE use, removing the SUID bit from fusermount3 where unnecessary, and restricting unprivileged user namespaces.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
A later kernel change, commit dabb90391028 titled "fuse: increase readdir buffer size," enabled practical exploitation by allowing oversized malicious dirents to be accepted. The article says practical reachability began with Linux v6.16-rc1 after this change.
The vulnerable Linux kernel logic in FUSE readdir caching was introduced by commit 69e34551152a, titled "fuse: allow caching readdir." This created the code path later identified as CVE-2026-31694.
The reported validation and proof of concept used the overflow to corrupt cached bytes from the SUID binary /usr/bin/su, replacing the start of executable code with a payload that called setuid(0) and setgid(0). The exploit reportedly produced a root shell on Ubuntu 26.04 running kernel 7.0.0-14-generic.
A patch was proposed and accepted upstream to reject FUSE directory entries whose serialized size exceeds PAGE_SIZE before caching them in fuse_add_dirent_to_cache(). The patch was marked for stable kernels v6.16 and later.
The upstream patch credits Qi Tang and Zijun Hu as the reporters of the FUSE page-cache overflow vulnerability tracked as CVE-2026-31694. The patch email also attributes the fix to Samuel Page.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **CVE-2026-31431**, dubbed **CopyFail**, a Linux local privilege escalation flaw in the kernel crypto subsystem's `algif_aead`/`AF_ALG` AEAD path that lets a low-privileged local user corrupt the page cache of readable files and gain root. The bug traces to a 2017 in-place AEAD optimization introduced in Linux 4.14 by commit `72548b093ee3`, which allowed splice-backed file pages to be reused as writable crypto buffers; attackers can then achieve a controlled write into the cached copy of targets such as setuid binaries while leaving the on-disk file unchanged. Researchers published a compact Python proof of concept said to work reliably across major distributions including Ubuntu, RHEL, SUSE, Amazon Linux, Debian, Fedora, and Arch, and warned the shared page cache also makes the flaw relevant for container escapes, CI runners, and multi-tenant cloud hosts. Upstream fixed the issue by reverting `algif_aead` to out-of-place operation in Linux **7.0**, **6.19.12**, and **6.18.22**, while older long-term branches initially lagged because the patch did not apply cleanly and required backports or workaround patches. Major vendors and downstream projects began shipping advisories and kernel updates, and temporary mitigations included disabling or blacklisting `algif_aead`, blocking `AF_ALG` socket creation with seccomp or eBPF, or using the kernel boot parameter `initcall_blacklist=algif_aead_init` where the feature was built in. After public exploit code spread and additional exploit ports appeared, **CISA added the flaw to its Known Exploited Vulnerabilities catalog**, and defenders published detections focused on suspicious `AF_ALG`, `splice()`, and setuid execution activity because traditional file-integrity checks may miss the in-memory-only tampering.
Aug 25, 2026
Researchers disclosed **Fragnesia** (`CVE-2026-46300`), a Linux kernel local privilege escalation flaw that allows an unprivileged local user to gain **root** by corrupting the kernel page cache for read-only files. The bug, discovered by William Bowling of Zellic and the V12 team, is described as a new variant in the Dirty Frag family and affects Linux kernels released before May 13, 2026. It stems from faulty bookkeeping when shared page fragments are merged in socket buffers and can be triggered through the kernel's XFRM **ESP-in-TCP** path, with additional exposure through `rxrpc` on some systems. A public proof-of-concept exploit modifies the in-memory copy of files such as `/usr/bin/su` to spawn a root shell while leaving the on-disk binary unchanged, reducing forensic visibility. Vendors and distributions moved quickly to publish advisories, patches, and mitigations as exploit code became public. AlmaLinux said releases 8, 9, and 10 are affected through `esp4` and `esp6`, with AlmaLinux 9 and 10 also exposed through `rxrpc` when `kernel-modules-partner` is installed, and released backported fixes ahead of upstream vendor updates. Recommended mitigations include disabling or blacklisting the `esp4`, `esp6`, and `rxrpc` kernel modules, restricting unprivileged user namespaces, and monitoring for suspicious namespace creation or XFRM manipulation; AlmaLinux also advised dropping page cache if compromise is suspected. The disclosure comes amid heightened concern over Linux local-root bugs in the same code area, and one cybercrime forum post reportedly advertised a Linux LPE zero-day for sale for **$170,000**.
Jun 29, 2026
Linux defenders are being urged to detect local privilege escalation through behavioral correlations rather than signatures for individual CVEs. Elastic’s framework combines endpoint and Auditd telemetry to identify unprivileged processes that reach UID 0 after executing from writable paths, invoking suspicious SUID/SGID binaries, manipulating user namespaces with `unshare`, abusing trusted helpers, or accessing privileged data. Testing covered 11 public proof-of-concept exploits and SUID misconfigurations, including page-cache corruption, D-Bus, namespace, and file-descriptor-theft techniques; the researchers caution that custom evasion-focused exploits may bypass coverage. The guidance follows active risk from page-cache vulnerabilities including **Copy Fail** (`CVE-2026-31431`), which is reported exploited in the wild and listed in CISA’s KEV catalog, and DirtyFrag. These flaws can modify cached readable files—including SUID binaries, `/usr/bin/su`, or `/etc/passwd`—to gain root, with suspicious socket, `splice()` and namespace activity providing detection opportunities. Defenders should patch affected kernels, consider restricting unprivileged user namespaces and relevant kernel modules after compatibility testing, and evict page cache after mitigation. They should also monitor `/proc/sys/fs/binfmt_misc` for new or changed handlers and attacker-controlled interpreters, as the `binfmt_misc` credentials flag can redirect a legitimate SUID program to a malicious handler that inherits root privileges without the handler carrying a SUID bit.
Sep 11, 2026