Cpe:2.3:o:linux:linux_kernel:7.1:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3olinuxlinux_kernel7.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 12 Oct 2026 18:29:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLocal Privilege Escalation via Out-of-Bounds Write in Linux Kernel FUSE readdirhttps://feed.craftedsignal.io/briefs/2026-10-linux-fuse-oob/Mon, 12 Oct 2026 18:29:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-linux-fuse-oob/CVE-2026-31694 is an out-of-bounds write vulnerability in the Linux kernel FUSE readdir implementation that allows local attackers to corrupt physically adjacent memory pages and achieve privilege escalation.CVE-2026-31694 is an out-of-bounds write vulnerability identified in the Linux kernel's FUSE (Filesystem in Userspace) readdir implementation, specifically within fs/fuse/readdir.c. The flaw occurs in fuse_add_dirent_to_cache() due to improper bounds checking. An attacker-controlled FUSE server can provide a dirent with a name length of 4095 bytes, which, when serialized, results in a 4120-byte record. The kernel attempts to copy this into a 4096-byte page cache, causing a 24-byte overwrite of the immediately following physical memory page.

This vulnerability affects Linux kernel versions 6.15 through 7.1. A proof-of-concept (PoC) exploit has been published, demonstrating how to use this primitive to corrupt filesystem cache entries, such as /etc/passwd. By modifying the root entry to remove the password requirement, a local attacker can gain root privileges. The issue was addressed in the Linux kernel via commit 51a8de6c50bf9.

Attack Chain

  1. Attacker establishes a malicious FUSE server on the target Linux system.
  2. Attacker interacts with the mount point to trigger a readdir operation.
  3. Malicious FUSE server returns a crafted dirent with a namelen of 4095.
  4. Kernel fuse_add_dirent_to_cache processes the dirent and performs a memory copy that exceeds the allocated page boundary by 24 bytes.
  5. Attacker uses memory grooming (e.g., exhausting PCP free page lists) to ensure a target page, such as a cached version of /etc/passwd, is placed physically adjacent to the FUSE cache page.
  6. The 24-byte overwrite corrupts the target page memory.
  7. Attacker triggers a read of the corrupted file or process to utilize the modified data.
  8. Final objective is achieved: execution of privileged commands via modified root credentials (e.g., su -s /bin/sh root).

Impact

Successful exploitation allows a local user with low privileges to escalate to root access on affected systems. This bypasses standard authentication and integrity controls by directly manipulating kernel-space memory representations of sensitive files. The exploit is probabilistic and poses a risk of system instability, kernel panics, or non-target memory corruption if the memory grooming fails to place the victim page correctly.

Recommendation

  • Patch all Linux kernel instances immediately; apply updates to versions >= 6.6.136, 6.12.84, 6.18.25, 7.0.2, or 7.1 where the fix for CVE-2026-31694 is integrated.
  • Restrict the ability of unprivileged users to mount FUSE filesystems if not required for the specific workload.
  • Monitor for the use of custom or unexpected FUSE mounts using system auditing tools (e.g., checking mount logs or /proc/mounts).
  • Audit for local processes performing unusual memory grooming activities or utilizing FUSE-related system calls in a suspicious manner.
]]>highadvisorylinuxkernelprivilege-escalationfuse