Linux Kernel FUSE Page-Cache Buffer Overflow (CVE-2026-31694) Enables Local Privilege Escalation

Linux Kernel FUSE Page-Cache Buffer Overflow (TL-2026-1177), also tracked as FUSE Dirent Cache Overflow, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-07-10. It has no confirmed attribution, affects Linux Kernel Linux Kernel (FUSE subsystem), references 1 CVE (CVE-2026-31694), maps to 16 MITRE ATT&CK techniques (T1059, T1068, T1070), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-1177

Threat ID
TL-2026-1177
Also known as
FUSE Dirent Cache Overflow, FUSE Page-Cache LPE
Severity
HIGH
CVSS
7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-10
Last reviewed
2026-07-10
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, cloud hosting, government administration, finance, education, managed-service-providers
Target regions
Global
Detection rules
9
Indicators of compromise
18

Malware and tooling in Linux Kernel FUSE Page-Cache Buffer Overflow

Malware and tooling: 0xCyberstan/CVE-2026-31694-POC

A missing bounds check in the Linux kernel FUSE subsystem's fuse_add_dirent_to_cache() lets a malicious FUSE server return an oversized directory entry (namelen=4095, serialized to 4120 bytes) that overflows a 4 KiB page-cache page by 24 bytes into adjacent kernel memory. On systems with 4 KiB pages an unprivileged local user with FUSE mount access can corrupt cached data such as SUID binaries or /etc/passwd to obtain a root shell.

How Linux Kernel FUSE Page-Cache Buffer Overflow works

CVE-2026-31694 is a CWE-787 out-of-bounds write in the Linux kernel's Filesystem in Userspace (FUSE) readdir caching path. The function fuse_add_dirent_to_cache() computes the serialized size of a directory entry (dirent) directly from a namelen field that is fully controlled by the userspace FUSE server, and then copies that record into a single page-cache page without first verifying the record actually fits within PAGE_SIZE. A malicious or compromised FUSE server can supply a dirent with namelen=4095, producing a 4120-byte serialized record -- 24 bytes larger than a standard 4 KiB page. When the kernel resets its write offset and copies the oversized record anyway, the trailing 24 bytes spill into the physically adjacent page in the page cache, corrupting whatever data currently occupies that page.

The bug became practically reachable starting with Linux 6.15/6.16-rc1, when the kernel began permitting larger FUSE readdir reply buffers, making oversized directory-entry batches easier to trigger. It affects a broad span of stable kernel branches (4.20 through 6.6.135, 6.7 through 6.12.83, 6.13 through 6.18.24, and 6.19 through 7.0.1), reflecting how the vulnerable dirent-caching logic has existed in various forms across many LTS lines while the specific overflow trigger depends on readdir buffer-size behavior introduced in newer trees.

Exploitation requires only local access and the ability to run or mount a FUSE filesystem -- available to unprivileged users via unprivileged user namespaces (CLONE_NEWUSER) or the setuid fusermount3 helper, both common in default container and desktop configurations. Security research firm Bynario published a working exploitation chain and a public PoC (0xCyberstan/CVE-2026-31694-POC) demonstrating two corruption primitives: (1) corrupting cached SUID executable code such as /usr/bin/su to inject a setuid(0)/setgid(0) call before normal execution, and (2) a more reliable technique that grooms the page allocator (draining per-CPU freelists to force buddy-adjacent physical pages) so the readdir cache page lands next to the cached /etc/passwd page, then uses the 24-byte overflow to blank root's password field, converting 'root:x:0:0:root:/root:/bin/bash' to 'root::0:0:root:/root:/bin/sh'. On systems where PAM permits nullok (an Ubuntu default), a subsequent 'su root' with an empty password yields a full root shell. The exploit is probabilistic (the PoC performs ~5 warmup rounds plus up to 200 attempts) and must be validated in VM/lab environments due to unpredictable physical-page placement in production memory layouts.

Systems using larger page sizes (e.g. 16 KiB/64 KiB pages on some ARM64 configurations) are not affected because the 4120-byte record no longer exceeds a single page. The upstream fix, landed across multiple stable-tree commits (45c05af363, 474ce83c96, 51a8de6c50, 7de93abfaa, d23ad78bfd, 038e61812f, 1d4a517fa9, 3059f9abe7), rejects any dirent that cannot fit within a single page before it is copied into the readdir cache. As of this research the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog and no confirmed in-the-wild exploitation has been reported, though a functional public PoC significantly lowers the bar for weaponization, particularly in multi-tenant Linux/container environments that expose unprivileged FUSE mounts.

MITRE ATT&CK techniques used in TL-2026-1177

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1548.001 Setuid and Setgid

Defense Evasion

T1070 Indicator Removal; T1211 Exploitation for Stealth

Initial Access

T1078 Valid Accounts

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Persistence

T1098 Account Manipulation; T1556 Modify Authentication Process

Impact

T1499 Endpoint Denial of Service; T1529 System Shutdown/Reboot

privilege-escalation

T1548 Abuse Elevation Control Mechanism

Credential Access

T1552 Unsecured Credentials; T1552.001 Credentials In Files; T1556 Modify Authentication Process

Affected products and versions in Linux Kernel FUSE Page-Cache Buffer Overflow

  • Linux Kernel — Linux Kernel (FUSE subsystem)
    Vulnerable versions: 4.20-6.6.135; 6.7-6.12.83; 6.13-6.18.24; 6.19-7.0.1
    Fixed in: stable-tree commits 45c05af36311, 474ce83c96a5, 51a8de6c50bf, 7de93abfaae1, d23ad78bfd20, 038e61812fa5, 1d4a517fa904, 3059f9abe7f1
  • Canonical — Ubuntu Linux Kernel
    Vulnerable versions: 24.04 LTS noble (WIP); 22.04 LTS jammy (WIP); 20.04 LTS focal
    Fixed in: 26.04 LTS resolute: linux 7.0.0-27.27, linux-aws 7.0.0-1008.8, linux-gcp 7.0.0-1007.7, linux-nvidia 7.0.0-1013.13
  • SUSE — SUSE Linux Enterprise / openSUSE
    Vulnerable versions: SUSE Linux Enterprise Server 16.1 (patch pending)
    Fixed in: SLE 15 SP4-SP7; SLE for SAP Applications 15 SP4-SP7; SLE Desktop 15 SP7; SLE 16.0; SLE HA Extension SP7/16.0; SLE HPC 15 SP4-SP7; SLE Micro 5.3-5.5, 6.0-6.1; SLE Real Time Module 15 SP7; openSUSE Leap 16.0; openSUSE Tumbleweed

Remediation for Linux Kernel FUSE Page-Cache Buffer Overflow

Patches

  • Apply stable kernel fix commits 45c05af36311, 474ce83c96a5, 51a8de6c50bf, 7de93abfaae1, d23ad78bfd20, 038e61812fa5, 1d4a517fa904, 3059f9abe7f1
  • Ubuntu 26.04 LTS (resolute): linux fixed in 7.0.0-27.27, linux-aws in 7.0.0-1008.8, linux-gcp in 7.0.0-1007.7, linux-nvidia in 7.0.0-1013.13
  • SUSE Linux Enterprise 15 SP4-SP7, SLE for SAP 15 SP4-SP7, SLE Desktop 15 SP7, SLE 16.0, SLE Micro 5.3-6.1, openSUSE Leap 16.0 and Tumbleweed: patches released; SUSE Linux Enterprise Server 16.1 patch pending

Immediate actions

  • Set /sys/module/fuse/parameters/userns_mounts to prohibit unprivileged FUSE mounts
  • Restrict or disable unprivileged user namespaces (CLONE_NEWUSER) via kernel.unprivileged_userns_clone=0 or equivalent LSM policy
  • Remove or restrict the setuid bit on fusermount3 where FUSE is not required for non-root users
  • Audit and restrict which local users/groups may mount FUSE filesystems (e.g. via /etc/fuse.conf user_allow_other and group membership)
  • Disable PAM nullok for su/sudo to prevent empty-password privilege escalation as a secondary control

Workarounds

  • Where patching is not immediately possible, block /dev/fuse access for non-root users via device cgroup or udev rules
  • Force larger memory page sizes where supported architecture and workload permit, as the overflow only triggers on 4 KiB pages

Longer-term hardening

  • Deploy kernel live-patching or scheduled reboot cadence to apply stable-tree fixes promptly across fleets
  • Enforce mandatory access control (SELinux/AppArmor) profiles that constrain which processes may load FUSE kernel modules or interact with fusermount3
  • Monitor for anomalous FUSE server processes and unexpected page-cache-heavy readdir workloads via kernel/eBPF-based auditing
  • Harden container runtimes to deny unprivileged FUSE device access by default (seccomp/AppArmor profiles blocking /dev/fuse)

CVEs associated with Linux Kernel FUSE Page-Cache Buffer Overflow

CVE-2026-31694

Weaknesses (CWE) in Linux Kernel FUSE Page-Cache Buffer Overflow

CWE-787, CWE-1284

Timeline of Linux Kernel FUSE Page-Cache Buffer Overflow

  • Approximate window in which larger FUSE readdir reply buffers (tied to Linux 6.15/6.16-rc1 behavior) made the oversized-dirent overflow practically reachable across deployed stable kernels.
  • Security research firm Bynario identifies and validates the fuse_add_dirent_to_cache() page-cache buffer overflow, demonstrating corruption of cached SUID executable code.
  • Upstream Linux kernel stable-tree maintainers develop and merge fix commits (45c05af363, 474ce83c96, 51a8de6c50, 7de93abfaa, d23ad78bfd, and related patches) rejecting oversized dirents before caching.
  • CVE-2026-31694 is assigned and published to NVD with a CVSS 3.1 base score of 7.8 (High).
  • Ubuntu and SUSE publish tracking advisories; Ubuntu ships fixed kernels for 26.04 LTS (resolute) and cloud kernel variants while 24.04/22.04/20.04 remain work-in-progress.
  • Cyber Security News and CyberPress publish technical writeups summarizing the vulnerability and exploitation requirements for a general security audience.
  • Public proof-of-concept exploit (0xCyberstan/CVE-2026-31694-POC) released on GitHub, demonstrating both SUID-binary corruption and a more reliable /etc/passwd page-cache corruption technique that empties root's password field for PAM nullok-based privilege escalation.
  • CVE-2026-31694 confirmed absent from the CISA Known Exploited Vulnerabilities catalog (version 2026.07.07); no confirmed in-the-wild exploitation reported as of this date.
  • Threadlinqs Intelligence Platform publishes consolidated threat intelligence record TL-2026-1177 covering the vulnerability, exploit chain, and remediation guidance.

Sources cited for Linux Kernel FUSE Page-Cache Buffer Overflow

Threats related to Linux Kernel FUSE Page-Cache Buffer Overflow

Detection coverage for TL-2026-1177

As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1177 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats