Linux Kernel FUSE Vulnerability Lets Attackers Gain Root Privileges

A Linux kernel vulnerability in the FUSE subsystem can allow a local attacker to gain root privileges by overflowing the page cache with attacker-controlled directory entries.

The flaw is tracked as CVE-2026-31694 and affects the code path used when the kernel caches FUSE readdir results.

FUSE lets a userspace filesystem talk to the kernel through /dev/fuse, and the kernel may cache directory entries for faster future reads.

Bynario analysis show the bug is in fuse_add_dirent_to_cache(), where the kernel calculates a directory entry size from a server-controlled filename length, then copies the entry into a single cache page without first checking whether the entry itself is larger than a single page.

That matters because a malicious FUSE server can return a directory entry whose serialized size is 4120 bytes on a 4 KiB page system, which is 24 bytes too large for a single page.

When the kernel resets the offset to zero and copies the record anyway, the extra bytes spill into the next page of memory. The dangerous part is not just memory corruption, but where the corrupted data lands.

Linux Kernel FUSE Vulnerability

In the reported validation, the overflow was used to corrupt cached bytes from a SUID binary such as /usr/bin/su, replacing the beginning of executable code with a short payload that calls setuid(0) and setgid(0) before continuing normally.

Once those identity-changing syscalls succeed inside a root-owned program, the attacker can bypass the usual authentication checks and spawn a root shell.

The attack is local, so the attacker needs the ability to mount or run a FUSE filesystem, which may be available through unprivileged user namespaces or fusermount3.

According to Bynario, the issue is exploitable on newer kernels with large readdir buffers and affects only systems using 4 KiB memory pages.

Systems with larger page sizes are not affected by this specific overflow size. The fix is simple: reject any directory entry that does not fit in a single page before caching it.

Administrators can also reduce exposure by limiting FUSE use, removing the setuid bit from fusermount3 when not needed, and restricting unprivileged namespaces where appropriate.

Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide