CVE-2026-31694

An oversized directory entry returned by a malicious FUSE server can overflow a Linux kernel page-cache page by 24 attacker-controlled bytes. Bynario demonstrated a working local privilege escalation on Ubuntu 26.04 by steering the overflow into the cached code of the SUID /usr/bin/su binary and executing the corrupted binary to obtain a root shell.

fuse_add_dirent_to_cache() checked whether a serialized directory entry fit in the remaining space of the current page, but did not reject an entry that was itself larger than PAGE_SIZE. A malicious FUSE server could set namelen to 4,095 and cause memcpy() to overwrite the following kernel page. The fix rejects directory entries that cannot fit within a single page before adding them to the readdir cache. Bynario classifies the issue as CWE-787; NVD currently provides no specific CWE.

The demonstrated exploit used unprivileged FUSE mounting to place a controlled page beside a cached page from /usr/bin/su. It overwrote the first 24 bytes of the binary's .init section with code that set the effective UID and GID to zero. Executing the corrupted cached binary then produced a root shell without modifying the file on disk.

References

• Bynario technical write-up and LPE demonstration

• NVD record

• Linux stable fix