CVE_2026_31694

CVE-2026-31694 パッシブスキャナ CVE-2026-31694 （LinuxカーネルのFUSE readdirキャッシュにおける領域外書き込み）向けのパッシブなLinuxホスト評価ツールです。 このスキャナは、実行中のカーネル、FUSEの露出状況、ローカルのパッケージメタデータ、カーネルソースの証跡、実行環境、OSファミリーを評価します。ホストが影響を受ける可能性がある場合、検出されたディストリビューションに合わせた緩和策ガイドを生成します。 作者: Aung Myat Thu w01f 目次 概要 脆弱性概要 セキュリティモデル 機能 要件 インストール 使用方法...

CVE-2026-31694-POC

CVE-2026-31694: FUSE readdirキャッシュの領域外書き込み fs/fuse/readdir.c:fuseadddirenttocacheにおける境界チェックの欠落。FUSEサーバーがnamelen = 4095のディレントを返すと、4120バイトのレコードにシリアライズされる。カーネルはこれを1つの4096バイトのページキャッシュページにコピーし、24バイトのサーバー制御データが次の物理ページにはみ出る（オーバーフローする）。...

Exploit for CVE-2026-31694

FUSE readdir cache out-of-bounds write PoC Local proof of con...

SUSE CVE-2026-31694

In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuseadddirenttocache computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks...

Linux Distros Unpatched Vulnerability : CVE-2026-31694

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fuse: reject oversized dirents in page cache fuseadddirenttocache computes a serialized dirent size from the server-controlled namelen field and copies the dire...

CVE-2026-31694

In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuseadddirenttocache computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks...

CVE-2026-31694 fuse: reject oversized dirents in page cache

In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuseadddirenttocache computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks...

CVE-2026-31694 fuse: reject oversized dirents in page cache

In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuseadddirenttocache computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks...

CVE-2026-31694

In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuseadddirenttocache computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks...

CVE-2026-31694

Summary: CVE-2026-31694 fixes a Linux kernel FUSE directory-entry handling flaw. A malicious FUSE server could cause a 24-byte overflow by returning a dirent whose serialized size (based on namelen) exceeds a single PAGE_SIZE. The bug arises in fuse_add_dirent_to_cache(), which previously only ch...

PT-2026-36324

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.16-rc1 and later affected versions not specified Description An out-of-bounds write issue exists in the fuse add dirent to cache function within the FUSE subsystem. The system calculates a serialized directory entry...