CVE-2026-31694-POC

CVE-2026-31694: FUSE readdir cache out-of-bounds write A missing bounds check in fs/fuse/readdir.c:fuseadddirenttocache. A FUSE server returns a dirent with namelen = 4095, which serializes to a 4120-byte record. The kernel copies it into a single 4096-byte page-cache page and overflows by 24...

CVE_2026_31694

CVE-2026-31694 Passive Scanner A passive Linux host assessment tool for CVE-2026-31694 , a FUSE readdir-cache out-of-bounds write in the Linux kernel. The scanner evaluates the running kernel, FUSE exposure, local package metadata, kernel source evidence, execution environment, and operating-syst...

Exploit for CVE-2026-31694

FUSE readdir cache out-of-bounds write PoC Local proof of con...

SUSE CVE-2026-31694

In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuseadddirenttocache computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks...

Linux Distros Unpatched Vulnerability : CVE-2026-31694

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fuse: reject oversized dirents in page cache fuseadddirenttocache computes a serialized dirent size from the server-controlled namelen field and copies the dire...

CVE-2026-31694

In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuseadddirenttocache computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks...

CVE-2026-31694 fuse: reject oversized dirents in page cache

In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuseadddirenttocache computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks...

CVE-2026-31694

In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuseadddirenttocache computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks...

CVE-2026-31694

Summary: CVE-2026-31694 fixes a Linux kernel FUSE directory-entry handling flaw. A malicious FUSE server could cause a 24-byte overflow by returning a dirent whose serialized size (based on namelen) exceeds a single PAGE_SIZE. The bug arises in fuse_add_dirent_to_cache(), which previously only ch...

CVE-2026-31694 fuse: reject oversized dirents in page cache

In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuseadddirenttocache computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks...

PT-2026-36324

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.16-rc1 and later affected versions not specified Description An out-of-bounds write issue exists in the fuse add dirent to cache function within the FUSE subsystem. The system calculates a serialized directory entry...