{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3olinuxlinux_kernel7.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-31694"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Linux Kernel (\u003c 6.6.136, 6.12.84, 6.18.25, 7.0.2, 7.1)"],"_cs_severities":["high"],"_cs_tags":["linux","kernel","privilege-escalation","fuse"],"_cs_type":"advisory","_cs_vendors":["Linux Foundation"],"content_html":"\u003cp\u003eCVE-2026-31694 is an out-of-bounds write vulnerability identified in the Linux kernel's FUSE (Filesystem in Userspace) readdir implementation, specifically within \u003ccode\u003efs/fuse/readdir.c\u003c/code\u003e. The flaw occurs in \u003ccode\u003efuse_add_dirent_to_cache()\u003c/code\u003e due to improper bounds checking. An attacker-controlled FUSE server can provide a dirent with a name length of 4095 bytes, which, when serialized, results in a 4120-byte record. The kernel attempts to copy this into a 4096-byte page cache, causing a 24-byte overwrite of the immediately following physical memory page.\u003c/p\u003e\n\u003cp\u003eThis vulnerability affects Linux kernel versions 6.15 through 7.1. A proof-of-concept (PoC) exploit has been published, demonstrating how to use this primitive to corrupt filesystem cache entries, such as \u003ccode\u003e/etc/passwd\u003c/code\u003e. By modifying the root entry to remove the password requirement, a local attacker can gain root privileges. The issue was addressed in the Linux kernel via commit \u003ccode\u003e51a8de6c50bf9\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes a malicious FUSE server on the target Linux system.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the mount point to trigger a readdir operation.\u003c/li\u003e\n\u003cli\u003eMalicious FUSE server returns a crafted dirent with a \u003ccode\u003enamelen\u003c/code\u003e of 4095.\u003c/li\u003e\n\u003cli\u003eKernel \u003ccode\u003efuse_add_dirent_to_cache\u003c/code\u003e processes the dirent and performs a memory copy that exceeds the allocated page boundary by 24 bytes.\u003c/li\u003e\n\u003cli\u003eAttacker uses memory grooming (e.g., exhausting PCP free page lists) to ensure a target page, such as a cached version of \u003ccode\u003e/etc/passwd\u003c/code\u003e, is placed physically adjacent to the FUSE cache page.\u003c/li\u003e\n\u003cli\u003eThe 24-byte overwrite corrupts the target page memory.\u003c/li\u003e\n\u003cli\u003eAttacker triggers a read of the corrupted file or process to utilize the modified data.\u003c/li\u003e\n\u003cli\u003eFinal objective is achieved: execution of privileged commands via modified root credentials (e.g., \u003ccode\u003esu -s /bin/sh root\u003c/code\u003e).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a local user with low privileges to escalate to root access on affected systems. This bypasses standard authentication and integrity controls by directly manipulating kernel-space memory representations of sensitive files. The exploit is probabilistic and poses a risk of system instability, kernel panics, or non-target memory corruption if the memory grooming fails to place the victim page correctly.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch all Linux kernel instances immediately; apply updates to versions \u0026gt;= 6.6.136, 6.12.84, 6.18.25, 7.0.2, or 7.1 where the fix for CVE-2026-31694 is integrated.\u003c/li\u003e\n\u003cli\u003eRestrict the ability of unprivileged users to mount FUSE filesystems if not required for the specific workload.\u003c/li\u003e\n\u003cli\u003eMonitor for the use of custom or unexpected FUSE mounts using system auditing tools (e.g., checking \u003ccode\u003emount\u003c/code\u003e logs or \u003ccode\u003e/proc/mounts\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAudit for local processes performing unusual memory grooming activities or utilizing FUSE-related system calls in a suspicious manner.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:29:05Z","date_published":"2026-10-12T18:29:05Z","id":"https://feed.craftedsignal.io/briefs/2026-10-linux-fuse-oob/","summary":"CVE-2026-31694 is an out-of-bounds write vulnerability in the Linux kernel FUSE readdir implementation that allows local attackers to corrupt physically adjacent memory pages and achieve privilege escalation.","title":"Local Privilege Escalation via Out-of-Bounds Write in Linux Kernel FUSE readdir","url":"https://feed.craftedsignal.io/briefs/2026-10-linux-fuse-oob/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:o:linux:linux_kernel:7.1:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}