Loading vulnerability…
CVE-2026-31694 is an out-of-bounds write in the Linux kernel FUSE readdir-cache path. In fuse_add_dirent_to_cache(), the kernel derives a serialized directory-entry length from the FUSE server-controlled namelen field and copies that entry into one page-cache page. The affected logic checked whether an entry fit in the remaining space of the current page, but failed to verify that the entry itself was no larger than PAGE_SIZE. A malicious FUSE server can therefore return an oversized entry; for example, a maximum-length name can yield a 4,120-byte serialized record. On systems using 4 KiB pages, this causes memcpy() to write 24 bytes beyond the cache page into the following kernel page. The upstream fix rejects entries whose serialized size exceeds PAGE_SIZE before copying them into the readdir cache.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a real local privilege escalation exploit for CVE-2026-31694, a Linux kernel FUSE readdir cache out-of-bounds write. The main exploit is a single statically linked C program (exploit.c) supported by Bash scripts that build a vulnerable kernel, create an Ubuntu 24.04 VM image, provision the guest, and run the exploit safely inside QEMU/KVM. Core capability: the exploit abuses a missing bounds check in fs/fuse/readdir.c where a malicious FUSE server returns a dirent with namelen=4095, producing a 4120-byte record copied into a 4096-byte page-cache page. This yields a 24-byte overflow into the next physical page. The exploit performs allocator grooming by draining free memory and arranging physically adjacent pages so the overflow lands on a chosen victim page. Two operating modes are documented and implemented: (1) marker PoC mode (--poc), which demonstrates the write primitive by checking for a controlled marker overwrite; and (2) full LPE mode, which targets the page-cache copy of /etc/passwd. The payload changes the root account entry so the password field is empty, then uses su with an empty password to obtain uid 0. After success, it attempts persistence by writing a reconstructed /etc/passwd, fixing permissions, dropping caches, and spawning a root shell. Repository structure: - exploit.c: main exploit logic, embedded FUSE server behavior, heap/page grooming, overwrite payload, and post-exploitation steps. - Makefile: builds a static exploit binary. - README.md: vulnerability description, usage, safety warnings, and expected behavior. - vm/build_vuln_kernel.sh: builds a vulnerable bzImage from a supplied kernel tree and removes the fix guard if present. - vm/make_rootfs.sh: creates an Ubuntu 24.04 qcow2 guest image with SSH, sudo, fuse3, and permissive settings needed for testing. - vm/provision_guest.sh: prepares /dev/fuse, ensures fuse3 is installed, and modifies PAM to allow nullok. - vm/run_vm.sh and vm/run_in_vm.sh: boot the VM and automate end-to-end exploitation. Notable endpoints are almost entirely local file paths and VM infrastructure artifacts rather than external C2 or remote targets. The only network-relevant items are the local SSH forwarding endpoint on 127.0.0.1:10022 and the Ubuntu package mirror used during VM image creation. Overall, this is an operational local kernel exploit with a hardcoded privilege-escalation payload, not merely a detector or README-only PoC.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Third-party component vulnerability listed in Dell advisory DSA-2026-393; the affected component and technical impact are not specified.
Third-party component vulnerability listed in Dell's advisory; the content does not provide its component mapping or technical details.
A page cache overflow vulnerability in the Linux kernel fs/fuse subsystem.
A Linux kernel page cache overflow vulnerability in the FUSE subsystem, mentioned as a separate bug to be covered in a later part.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.