Linux FUSE Page Cache Overflow Lets Local Attackers Gain Root Access

A newly disclosed Linux kernel vulnerability in the Filesystem in Userspace (FUSE) subsystem could allow unprivileged local attackers to gain root privileges on affected systems. Tracked as CVE-2026-31694, the flaw stems from a page-cache overflow in FUSE directory-entry caching logic. Documented by Bynario, who discovered and validated the issue using an LLM-driven vulnerability research pipeline. […] The post Linux FUSE Page Cache Overflow Lets Local Attackers Gain Root Access appeared first on Cyber Security News.

A newly disclosed Linux kernel vulnerability in the Filesystem in Userspace (FUSE) subsystem could allow unprivileged local attackers to gain root privileges on affected systems. Tracked as CVE-2026-31694, the flaw stems from a page-cache overflow in FUSE directory-entry caching logic. Documented by Bynario, who discovered and validated the issue using an LLM-driven vulnerability research pipeline. The vulnerability affects systems using Linux kernel versions where larger FUSE readdir reply buffers make oversized directory entries reachable, beginning with Linux 6.16-rc1. A patch has since been accepted upstream. Linux FUSE Page Cache Overflow FUSE enables users to implement filesystems in user space while the kernel handles low-level filesystem interactions. A FUSE daemon communicates with the kernel through /dev/fuse and supplies responses for operations such as directory enumeration. This design permits unprivileged users to mount certain FUSE filesystems, but it also means a malicious FUSE server can control portions of the data processed by the kernel. The issue exists in fuse_add_dirent_to_cache(), a function that caches directory entries when a FUSE server enables the FOPEN_CACHE_DIR option. The function copies serialized fuse_dirent records into fixed-size page-cache pages, generally 4 KiB on x86_64 systems. A directory entry’s serialized size is derived from its attacker-controlled filename-length field. Although FUSE limits names to 4095 bytes, the resulting aligned directory-entry record can reach 4120 bytes. That exceeds the standard 4096-byte kernel page size by 24 bytes. The vulnerable code checks whether an entry fits in the remaining space of the current page. If not, it advances to a new page and resets the write offset. However, it fails to verify that the directory entry itself fits within an entirely empty page. As a result, copying a maximum-sized FUSE directory entry can write up to 242424 attacker-controlled bytes beyond the allocated page-cache page. According to Bynario’s validation, the overflow can be weaponized into local privilege escalation under favorable memory-layout conditions. The proof of concept reportedly targets adjacent page-cache data belonging to a privileged executable, modifying cached initialization code before execution. When successful, this can allow an unprivileged user to execute code in the context of a set-user-ID root binary and obtain root access. Practical exploitation requires local access and the ability to mount or interact with a malicious FUSE filesystem. Systems with page sizes larger than 4 KiB are not affected because the largest possible FUSE directory record remains within a single page. The root cause dates to a 2018 commit that introduced FUSE directory caching. However, the flaw became practically reachable after an April 2025 kernel change increased the FUSE readdir buffer size, allowing the oversized record to be accepted. Mitigation The upstream fix adds a direct validation check: directory entries larger than PAGE_SIZE are no longer cached. Administrators should apply kernel updates containing the patch associated with commit 51a8de6c50bf947c8f534cd73da4c8f0a13e7bed. Until patched kernels are deployed, organizations should restrict unprivileged FUSE mounts where possible, review user-namespace policies, and consider removing the setuid permission from fusermount3 on systems where FUSE is not required. These measures can reduce the attack surface for local privilege-escalation attempts. Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google. The post Linux FUSE Page Cache Overflow Lets Local Attackers Gain Root Access appeared first on Cyber Security News.