Loading vulnerability…
Linux kernel FUSE directory-entry page-cache overflow
CVE-2026-31694 is an out-of-bounds write vulnerability in the Linux kernel FUSE subsystem's fuse_add_dirent_to_cache() function. The function derives a serialized directory-entry size from the FUSE server-controlled namelen field and copies the entry into a single page-cache page. Although it checks the remaining space in the current page and moves to a fresh page when necessary, it does not verify that the entry itself fits within PAGE_SIZE. A malicious FUSE server can supply namelen=4095, producing a 4,120-byte serialized record and causing memcpy() to write 24 bytes beyond a 4 KiB cache page into the following kernel page. The overflow can enable local privilege escalation through corruption of adjacent cached data.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can corrupt an adjacent kernel page with attacker-controlled bytes from the directory-entry filename tail. A proof of concept demonstrated local privilege escalation to root on Ubuntu 26.04 running kernel 7.0.0-14-generic by corrupting cached executable bytes of a root-owned SUID program. Successful exploitation can compromise system confidentiality, integrity, and availability; memory corruption can also cause system instability or denial of service.
If you can’t patch tonight, do this now.
Until patched, restrict untrusted users' ability to mount or operate FUSE filesystems and avoid filesystems served by untrusted FUSE processes. Where operationally appropriate, remove the setuid permission from the fusermount3 helper if it is unnecessary and restrict unprivileged user namespaces. Address both mounting mechanisms where available; restricting only one may leave another route to FUSE access.
Patch, then assume compromise.
Install a distribution-supported kernel update containing the fix that rejects serialized directory entries larger than PAGE_SIZE before copying them into the FUSE readdir cache, then reboot into the patched kernel. Fixed package versions vary by distribution and branch; use the vendor's CVE-specific package guidance rather than relying solely on the upstream kernel version. The upstream correction adds an early size check in fuse_add_dirent_to_cache().
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.