CVE-2026-31694

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.16-rc1 and later (affected versions not specified)

Description An out-of-bounds write issue exists in the fuse add dirent to cache() function within the FUSE subsystem. The system calculates a serialized directory entry (dirent) size based on the server-controlled namelen field and copies it into a single page-cache page. Because the logic fails to verify if the dirent itself exceeds the PAGE SIZE, a malicious FUSE server can provide a namelen of 4095, resulting in a record size of 4120 bytes. On systems with 4 KiB pages, this causes a memcpy() operation to overflow the cache page by 24 bytes into the subsequent kernel page. A local low-privileged attacker can exploit this by interacting with a malicious FUSE filesystem to achieve kernel memory corruption, potentially leading to local privilege escalation to root, denial of service, or arbitrary code execution in the kernel context.

Recommendations Update the Linux kernel to the latest patched version. Restrict unprivileged FUSE mounts to minimize the risk of exploitation.