Critical Linux Kernel FUSE Page Cache Overflow (CVE-2026-31694) Enables Root Access

Overview

A newly disclosed critical local privilege escalation (LPE) vulnerability, tracked as CVE-2026-31694, has been identified in the Filesystem in Userspace (FUSE) subsystem of the Linux kernel. This flaw enables unprivileged local attackers to elevate their privileges to root on affected systems. The vulnerability was discovered and validated by Bynario using an LLM-driven vulnerability research pipeline, highlighting the evolving methods in cybersecurity analysis. A patch for this critical issue has already been accepted upstream, underscoring the urgency of remediation.

Technical Details

CVE-2026-31694 originates from a page-cache overflow within the fuse_add_dirent_to_cache() function, which is part of the FUSE directory-entry caching logic. In essence, FUSE allows user-space programs to implement filesystems, with the kernel handling the low-level interactions. When a FUSE server enables the FOPEN_CACHE_DIR option, this function caches directory entries. The vulnerability arises because a directory entry’s serialized size is derived from an attacker-controlled filename-length field. Although FUSE imposes a limit of 4095 bytes for filenames, the resulting aligned directory-entry record can reach up to 4120 bytes.

The crucial flaw is that while the vulnerable code checks if an entry fits into the remaining space of the current 4 KiB (4096-byte) page, it fails to verify if the entire directory entry itself fits within a completely empty page. Consequently, copying a maximum-sized FUSE directory entry can result in writing up to 24 attacker-controlled bytes beyond the allocated 4096-byte kernel page. This out-of-bounds write capability allows a local attacker to corrupt kernel memory, which can then be exploited to achieve full root privileges on the system. The vulnerability specifically affects Linux kernel versions where larger FUSE readdir reply buffers are in use, starting with Linux 6.16-rc1.

Real-World Impact

The real-world impact of CVE-2026-31694 is severe. A local privilege escalation vulnerability allows an attacker who has already gained initial, unprivileged access to a Linux system to escalate their permissions to the highest level (root). This means they can completely bypass security controls, install arbitrary software, modify system configurations, access all data, and potentially take full control of the compromised machine. Such a capability is highly prized by threat actors, as it can be the final step in a multi-stage attack, enabling persistence, data exfiltration, or the deployment of rootkits and other advanced malware. For servers, workstations, and embedded devices running affected Linux kernels, this flaw represents a fundamental compromise of system integrity.

Threat Landscape

Kernel-level privilege escalation vulnerabilities are among the most critical flaws in any operating system, as they directly undermine the core security model. They are actively sought out and chained with other vulnerabilities (e.g., remote code execution flaws) to achieve comprehensive system compromise. The discovery method, utilizing an LLM-driven vulnerability research pipeline, also signals a shift in how such deep-seated flaws might be identified in the future, potentially leading to faster discovery rates for complex vulnerabilities. This underscores the need for continuous security research and proactive patching in the Linux ecosystem, especially given its widespread use in servers, cloud environments, and IoT devices.

Remediation

A patch for CVE-2026-31694 has already been integrated upstream into the Linux kernel. Therefore, the primary remediation for this vulnerability is for system administrators to apply the latest kernel updates for their respective Linux distributions immediately. Users of Linux kernel versions 6.16-rc1 and newer should prioritize updating their systems. It is crucial to ensure that the installed kernel version includes the fix for this FUSE page-cache overflow. In addition to patching, maintaining a principle of least privilege, segmenting networks to limit the blast radius of any compromise, and implementing robust monitoring for unusual process activity or attempts to interact with the FUSE subsystem from unprivileged users are important defensive measures.

---