CVE-2026-31694

What it actually does

This is a local Linux kernel buffer overflow in the FUSE readdir cache path. A FUSE server controls directory entry name lengths returned to the kernel; if it returns an oversized directory entry, the kernel calculates a serialized record larger than a single page and copies it into a page-cache page without first rejecting records that exceed PAGE_SIZE. On common 4 KiB page systems, a crafted name length such as 4095 can cause a small overwrite past the end of the target kernel page into the next page. Depending on kernel configuration, memory layout, and exploitation reliability, this can lead to kernel memory corruption, denial of service through a crash, or potentially local privilege escalation.

Why it matters to the business

Systems that allow untrusted users or workloads to run FUSE filesystems are most exposed. Successful exploitation could let a local attacker disrupt Linux hosts or containers by crashing the kernel, and in a worst case could allow privilege escalation to kernel-level control. The current EPSS is low and no known exploited-in-the-wild or ransomware use is reported, but the vulnerability affects a core operating system component and should be remediated through normal kernel patching, especially on multi-user servers, developer workstations, virtualization hosts, container platforms, and systems where user namespaces or FUSE mounts are enabled.

How an attack unfolds

An attacker first needs local code execution with enough privileges to operate or interact with a malicious FUSE filesystem. The attacker runs or controls a FUSE server that returns a directory listing containing a crafted directory entry with an excessive name length. When a process performs a directory read against that FUSE mount, the Linux kernel receives the malicious directory entry and attempts to cache it. Because the vulnerable kernel checks only whether the record fits in the remaining page space, not whether the record can fit in a page at all, it may copy more data than the target page can hold. This corrupts adjacent kernel memory. A basic exploit may simply trigger a kernel panic or fault; a more advanced exploit would attempt to shape adjacent kernel memory and use the overflow to alter kernel data structures for privilege escalation.

How to fix it

Apply a Linux kernel update that includes the FUSE fix rejecting directory entries that cannot fit within a single page before copying them into the readdir cache. No exact fixed package versions were provided in the input, so use the patched kernel version supplied by the relevant Linux distribution or vendor advisory for CVE-2026-31694. Prioritize systems where untrusted users can mount FUSE filesystems, where user namespaces allow unprivileged FUSE use, or where third-party FUSE servers are used. If immediate patching is not possible, reduce exposure by restricting FUSE mount capability to trusted administrators, disabling unprivileged user namespaces where operationally acceptable, reviewing /dev/fuse access permissions, and limiting or removing unnecessary FUSE-based tooling until patching is complete.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel package is at or above the vendor-fixed version and that the host has been rebooted into the patched kernel, not merely had the package installed. Validate with package-manager inventory, kernel version checks such as `uname -r`, and distribution security advisory tooling. Confirm whether FUSE is exposed by checking for loaded FUSE support, the presence and permissions of `/dev/fuse`, active FUSE mounts in `/proc/mounts` or `findmnt`, and whether unprivileged users can invoke FUSE mount helpers. For high-assurance validation, use vendor-provided regression tests or a non-production proof-of-concept that attempts to return an oversized FUSE directory entry and verify that the patched kernel rejects it without a crash or memory-safety warning.

Typical attack path

1. Obtain local access to a Linux system where FUSE use is permitted.
2. Start or control a malicious FUSE server or mount a crafted FUSE filesystem.
3. Return a directory entry with an oversized server-controlled name length during a readdir operation.
4. Trigger a directory listing or file enumeration against the malicious FUSE mount.
5. Cause the kernel to copy the oversized serialized directory entry into the page cache, overflowing the page boundary.
6. Use the resulting kernel memory corruption to crash the system or attempt local privilege escalation.

How to detect it

Look for evidence of exploitation in kernel logs, crash dumps, audit logs, and process execution telemetry. Key sources include `dmesg`, journald kernel logs, `/var/log/kern.log`, `/var/log/messages`, auditd records, EDR process telemetry, mount records, and crash dump systems such as kdump. Investigate kernel oops, panic, KASAN, or memory-corruption messages that occur near FUSE mount activity or directory enumeration. Correlate suspicious events with executions of FUSE mount helpers, creation of unusual FUSE mounts, access to `/dev/fuse`, and short-lived custom FUSE server processes. Because the vulnerability is a local kernel memory corruption issue, exploitation may leave few durable artifacts beyond kernel faults, crash dumps, suspicious FUSE mounts, and process history. There are no public reports of exploitation in the wild or named threat actors in the provided data, so detection should focus on abnormal FUSE behavior and kernel memory-corruption symptoms rather than campaign-specific indicators.

• fuse_add_dirent_to_cache
• KASAN: slab-out-of-bounds
• KASAN: out-of-bounds
• BUG: unable to handle page fault
• general protection fault
• kernel panic
• Oops:
• fs/fuse
• /dev/fuse
• fusermount
• fusermount3
• type fuse
• type fuseblk
• mount.fuse
• mount.fuse3

What your security team should do

• Patch affected Linux kernels using vendor-supported updates and reboot into the fixed kernel, prioritizing multi-user systems and hosts that allow untrusted FUSE usage.
• Inventory active FUSE usage across fleets by collecting `/proc/mounts`, `findmnt`, `/dev/fuse` permissions, and package usage for common FUSE servers.
• Temporarily restrict FUSE to trusted users only where patching is delayed, including reviewing group membership and mount helper permissions.
• Assess whether unprivileged user namespaces are required; disable or restrict them where they unnecessarily expand local attack surface.
• Monitor kernel logs for crashes, KASAN reports, general protection faults, or warnings involving FUSE directory reading and `fuse_add_dirent_to_cache`.
• Treat suspicious kernel crashes following FUSE mount activity as potentially security-relevant and preserve logs, crash dumps, and process accounting data for investigation.
• Track Linux distribution advisories for the exact fixed kernel versions because no fixed version list was provided in the vulnerability metadata.