Linux Kernel FUSE Page Cache Overflow Enables Local Root Escalation

A flaw in the Linux kernel FUSE subsystem, tracked as CVE-2026-31694, allows a local attacker to escalate privileges to root by exploiting how cached directory entries are handled during readdir operations. The bug is in fuse_add_dirent_to_cache(), where an attacker-controlled serialized FUSE directory entry can be copied into a single 4 KiB cache page without verifying that the entry itself fits, causing a 24-byte overflow and adjacent memory corruption on affected systems. Reports say a malicious FUSE server can trigger the issue through oversized filename data returned to the kernel.

Researchers demonstrated exploitation by corrupting cached bytes associated with a SUID binary such as /usr/bin/su, including a proof of concept that modified the cached .init page on Ubuntu 26.04 to execute code that calls setuid(0) and setgid(0) before spawning a root shell. The vulnerable logic was introduced in 2018, but practical exploitation reportedly became reachable with Linux v6.16-rc1 after a 2025 increase to the readdir buffer size. An upstream patch has been accepted to reject directory entries whose serialized size exceeds PAGE_SIZE before caching, while interim mitigations include limiting FUSE use, removing the SUID bit from fusermount3 where unnecessary, and restricting unprivileged user namespaces.