# Linux Kernel FUSE Page-Cache Buffer Overflow (CVE-2026-31694) Enables Local Privilege Escalation

> A missing bounds check in the Linux kernel FUSE subsystem's fuse_add_dirent_to_cache() lets a malicious FUSE server return an oversized directory entry (namelen=4095, serialized to 4120 bytes) that overflows a 4 KiB page-cache page by 24 bytes into adjacent kernel memory. On systems with 4 KiB pages an unprivileged local user with FUSE mount access can corrupt cached data such as SUID binaries or /etc/passwd to obtain a root shell.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1177
- **ID:** TL-2026-1177
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-31694

## Description

CVE-2026-31694 is a CWE-787 out-of-bounds write in the Linux kernel's Filesystem in Userspace (FUSE) readdir caching path. The function fuse_add_dirent_to_cache() computes the serialized size of a directory entry (dirent) directly from a namelen field that is fully controlled by the userspace FUSE server, and then copies that record into a single page-cache page without first verifying the record actually fits within PAGE_SIZE. A malicious or compromised FUSE server can supply a dirent with namelen=4095, producing a 4120-byte serialized record -- 24 bytes larger than a standard 4 KiB page. When the kernel resets its write offset and copies the oversized record anyway, the trailing 24 bytes spill into the physically adjacent page in the page cache, corrupting whatever data currently occupies that page.

The bug became practically reachable starting with Linux 6.15/6.16-rc1, when the kernel began permitting larger FUSE readdir reply buffers, making oversized directory-entry batches easier to trigger. It affects a broad span of stable kernel branches (4.20 through 6.6.135, 6.7 through 6.12.83, 6.13 through 6.18.24, and 6.19 through 7.0.1), reflecting how the vulnerable dirent-caching logic has existed in various forms across many LTS lines while the specific overflow trigger depends on readdir buffer-size behavior introduced in newer trees.

Exploitation requires only local access and the ability to run or mount a FUSE filesystem -- available to unprivileged users via unprivileged user namespaces (CLONE_NEWUSER) or the setuid fusermount3 helper, both common in default container and desktop configurations. Security research firm Bynario published a working exploitation chain and a public PoC (0xCyberstan/CVE-2026-31694-POC) demonstrating two corruption primitives: (1) corrupting cached SUID executable code such as /usr/bin/su to inject a setuid(0)/setgid(0) call before normal execution, and (2) a more reliable technique that grooms the page allocator (draining per-CPU freelists to force buddy-adjacent physical pages) so the readdir cache page lands next to the cached /etc/passwd page, then uses the 24-byte overflow to blank root's password field, converting 'root:x:0:0:root:/root:/bin/bash' to 'root::0:0:root:/root:/bin/sh'. On systems where PAM permits nullok (an Ubuntu default), a subsequent 'su root' with an empty password yields a full root shell. The exploit is probabilistic (the PoC performs ~5 warmup rounds plus up to 200 attempts) and must be validated in VM/lab environments due to unpredictable physical-page placement in production memory layouts.

Systems using larger page sizes (e.g. 16 KiB/64 KiB pages on some ARM64 configurations) are not affected because the 4120-byte record no longer exceeds a single page. The upstream fix, landed across multiple stable-tree commits (45c05af363, 474ce83c96, 51a8de6c50, 7de93abfaa, d23ad78bfd, 038e61812f, 1d4a517fa9, 3059f9abe7), rejects any dirent that cannot fit within a single page before it is copied into the readdir cache. As of this research the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog and no confirmed in-the-wild exploitation has been reported, though a functional public PoC significantly lowers the bar for weaponization, particularly in multi-tenant Linux/container environments that expose unprivileged FUSE mounts.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1548.001 Setuid and Setgid
- T1211 Exploitation for Stealth
- T1548 Abuse Elevation Control Mechanism
- T1552 Unsecured Credentials
- T1552.001 Credentials In Files
- T1556 Modify Authentication Process
- T1556 Modify Authentication Process
- T1098 Account Manipulation
- T1499 Endpoint Denial of Service
- T1529 System Shutdown/Reboot
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1070 Indicator Removal
- T1078 Valid Accounts

## Sources

- [Linux Kernel FUSE Vulnerability](https://cybersecuritynews.com/linux-kernel-fuse-vulnerability/)
- [CVE-2026-31694 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-31694)
- [CVE-2026-31694: Linux Kernel Buffer Overflow Vulnerability - SentinelOne](https://www.sentinelone.com/vulnerability-database/cve-2026-31694/)
- [Linux FUSE Page Cache Overflow Lets Local Attackers Gain Root Access](https://cyberpress.org/linux-fuse-page-cache-overflow/)
- [CVE-2026-31694 Common Vulnerabilities and Exposures - SUSE](https://www.suse.com/security/cve/CVE-2026-31694.html)
- [CVE-2026-31694 - Ubuntu](https://ubuntu.com/security/CVE-2026-31694)
- [GHSA-8fxx-fj7q-42m6 - GitHub Advisory Database](https://github.com/advisories/GHSA-8fxx-fj7q-42m6)
- [CVE-2026-31694-POC: Linux kernel FUSE readdir cache out-of-bounds write PoC](https://github.com/0xCyberstan/CVE-2026-31694-POC)
- [Linux Distros Unpatched Vulnerability: CVE-2026-31694 - Tenable](https://www.tenable.com/plugins/nessus/311645)
- [CVE-2026-31694 - Overview, Insights & Trends - Intruder](https://cvemon.intruder.io/cves/CVE-2026-31694)
- [CVE-2026-31694 - THREATINT](https://cve.threatint.eu/CVE/CVE-2026-31694)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Stable fix commit 474ce83c96a55f2eeb14dee2be375eeadfdacdf5](https://git.kernel.org/stable/c/474ce83c96a55f2eeb14dee2be375eeadfdacdf5)
- [Stable fix commit 51a8de6c50bf947c8f534cd73da4c8f0a13e7bed](https://git.kernel.org/stable/c/51a8de6c50bf947c8f534cd73da4c8f0a13e7bed)
- [Stable fix commit 7de93abfaae1b2dc94da8a07a36421bd073f1d8f](https://git.kernel.org/stable/c/7de93abfaae1b2dc94da8a07a36421bd073f1d8f)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1177