CVE-2026-31694

A flaw was found in the Linux kernel's Filesystem in Userspace (FUSE) component. A malicious FUSE server could exploit this by providing an oversized directory entry (dirent) that is not properly validated. This improper validation causes a memory copy operation to write beyond the allocated buffer, leading to a 24-byte overflow into an adjacent kernel memory page. This memory corruption could potentially lead to information disclosure or other unpredictable system behavior.

A moderate severity flaw was found in the Linux kernel's Filesystem in Userspace (FUSE) subsystem. The FUSE server that backs a mounted FUSE filesystem controls the namelen field of the directory entries (dirents) it returns. The kernel's fuse_add_dirent_to_cache() function computed the serialized dirent size from this server-controlled field and copied the dirent into a single page-cache page, but it only checked whether the dirent fit in the remaining space of the current page and never checked whether the dirent itself exceeded PAGE_SIZE. A malicious FUSE server could therefore return a dirent with namelen=4095, producing a 4120-byte serialized record; on systems with 4 KiB pages, the memcpy() overflowed the readdir cache page by 24 bytes into the following kernel page. This memory corruption could lead to information disclosure or other unpredictable system behavior, including system crashes. Red Hat Enterprise Linux 6 through 10 (including the kernel-rt builds) are not affected because the vulnerable code is not present in the shipped kernels. Red Hat In-Vehicle OS 2 is affected, and a fix is being pursued for that product through its delegated maintenance process. Red Hat rates the impact of this flaw as Moderate; the Red Hat CVSS 3.1 score of 7.0 differs from the CVE.org score of 7.8 mainly in the higher attack complexity assigned by Red Hat.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.