Linux Kernel FUSE Vulnerability (CVE-2023-XXXX) Lets Attackers Gain Root Privileges

Key Takeaways

• A critical vulnerability, CVE-2026-31694, has been identified in the Linux kernel’s FUSE subsystem.
• Local attackers can exploit this flaw to achieve root privileges by manipulating directory entry caching.
• The vulnerability specifically impacts systems utilizing 4 KiB memory pages and newer kernels with large readdir buffers.
• A patch is available, and administrators are advised to implement mitigation strategies.

A significant security flaw has been discovered within the Linux kernel’s FUSE (Filesystem in Userspace) subsystem, potentially allowing a local attacker to escalate privileges to root. The vulnerability, identified as CVE-2026-31694, stems from an overflow in the kernel’s page cache when processing directory entries controlled by a malicious FUSE filesystem.

Understanding the FUSE Vulnerability

FUSE facilitates communication between userspace filesystems and the kernel via the /dev/fuse device. To enhance performance, the kernel often caches directory entries for subsequent read operations. The core of this vulnerability lies within the fuse_add_dirent_to_cache() function.

According to Bynario, the kernel calculates the size of a directory entry based on a filename length provided by the FUSE server. Crucially, it then attempts to copy this entry into a single cache page without first verifying if the entry’s serialized size exceeds the page’s capacity. This oversight creates a critical buffer overflow scenario.

Researchers demonstrated that a specially crafted FUSE server could return a directory entry with a serialized size of 4120 bytes on a system configured with 4 KiB (4096 bytes) memory pages. This size is 24 bytes larger than a single page. When the kernel proceeds to copy this oversized record, it resets the offset to zero, causing the excess bytes to spill over into the subsequent memory page. This memory corruption is not merely a data integrity issue; its danger lies in the location where the overwritten data lands.

Exploitation and Impact

During the reported validation, the overflow was leveraged to corrupt cached bytes associated with a SUID (Set User ID) binary, such as /usr/bin/su. By overwriting the initial portion of the executable code with a concise payload, the attacker could force the program to execute setuid(0) and setgid(0), effectively granting root privileges before the program continues its normal execution flow. With these identity-changing syscalls successfully executed within a root-owned program, an attacker can circumvent standard authentication mechanisms and launch a root shell.

The attack necessitates local access, meaning the perpetrator must have the capability to mount or execute a FUSE filesystem. This capability might be available through unprivileged user namespaces or the fusermount3 utility.

The issue is particularly exploitable on newer Linux kernels that employ larger readdir buffers and exclusively affects systems configured with 4 KiB memory pages. Systems with larger page sizes are not susceptible to this specific overflow condition. The recommended fix involves a straightforward modification: the kernel should explicitly reject any directory entry that cannot fit within a single page before attempting to cache it.

What You Should Do

• Apply the latest kernel updates as soon as they become available to patch CVE-2026-31694.
• Limit the use of FUSE filesystems to essential services and trusted users.
• Consider removing the setuid bit from the fusermount3 utility if it is not strictly required for your operational environment.
• Restrict the use of unprivileged user namespaces where appropriate to further reduce the attack surface.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.