PT-2026-36324 · Linux · Linux Kernel

Published 2026-05-01 · Updated 2026-05-22 · CVE-2026-31694

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the fuse add dirent to cache() function where the system computes a serialized directory entry (dirent) size based on the server-controlled namelen field and copies it into a single page-cache page. The logic fails to verify if the dirent itself exceeds the PAGE SIZE, only checking if it fits in the remaining space of the current page. Consequently, a malicious FUSE server can provide a dirent with namelen set to 4095, resulting in a serialized record size of 4120 bytes. On systems with 4 KiB pages, this leads to a memcpy() operation that overflows the cache page by 24 bytes into the subsequent kernel page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31694

ECHO-108A-C04C-F9EF

OPENSUSE-SU-2026:10793-1

Affected Products

Linux Kernel

References · 59

• https://git.kernel.org/stable/c/7de93abfaae1b2dc94da8a07a36421bd073f1d8f · Patch
• https://git.kernel.org/stable/c/474ce83c96a55f2eeb14dee2be375eeadfdacdf5 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31694 · Vendor Advisory
• https://git.kernel.org/stable/c/45c05af36311624c1148123caeb011312495d86b · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-31694 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31694 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31694 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-31694 · Vendor Advisory
• https://git.kernel.org/stable/c/51a8de6c50bf947c8f534cd73da4c8f0a13e7bed · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31694 · Security Note
• https://ubuntu.com/security/CVE-2026-31694 · Vendor Advisory
• https://git.kernel.org/stable/c/d23ad78bfd205eac26766e38ba7d79f279131098 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10793-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-31708 · Note
• https://suse.com/security/cve/CVE-2026-43072 · Note