{
  "claim": {
    "argus_claim_ref": null,
    "attacker_control": "malicious FUSE server / daemon returning a crafted dirent with server-controlled namelen",
    "claimed_surface": "local_only",
    "expected_impact": "privilege_escalation",
    "finding_id": null,
    "id": null,
    "required_entrypoint_detail": "FUSE readdir cache path in fs/fuse/readdir.c via fuse_add_dirent_to_cache() with a FUSE server-supplied dirent",
    "required_entrypoint_kind": "local_kernel_runtime",
    "submission_reason": "ticket_derived_llm",
    "trigger_class": "local_execution",
    "upstream_verdicts": {
      "claim_extraction": {
        "confidence": "high",
        "model": "accounts/fireworks/models/kimi-k2p7-code",
        "reason": "Ticket describes a missing bounds check in fs/fuse/readdir.c where a malicious FUSE server can supply a namelen that produces a record larger than PAGE_SIZE, causing an out-of-bounds write into an adjacent kernel page. The advisory explicitly claims unprivileged local privilege escalation by corrupting the page-cache copy of /etc/passwd, and provides a public PoC for reproduction in a QEMU/KVM VM.",
        "source": "llm"
      }
    }
  },
  "latest_description": "A missing bounds check in the Linux kernel FUSE readdir cache allows a malicious FUSE server to overflow a page-cache page by 24 bytes. In `fs/fuse/readdir.c`, `fuse_add_dirent_to_cache()` computes the serialized directory-entry size from the server-controlled `namelen` field and copies it into a single page-cache page. The check `offset + reclen > PAGE_SIZE` only handles records that do not fit in the remaining space of the current page; it does not reject records larger than `PAGE_SIZE` itself. After the `FUSE_NAME_MAX` increase to `PATH_MAX-1` (4095) in Linux 6.16 (commit 27992ef80770d), a FUSE daemon can return a dirent with `namelen=4095`, producing a 4120-byte record that overflows a 4 KiB page by 24 bytes into the adjacent kernel page. This can be exploited for unprivileged local privilege escalation by corrupting the page-cache copy of `/etc/passwd`. Affected versions are reachable from v6.16 through v7.0-rc and stable branches before their respective fixes. Reproduction uses the public PoC at https://github.com/0xCyberstan/CVE-2026-31694-POC inside a QEMU/KVM VM running a vulnerable kernel.",
  "product": "Linux kernel (FUSE subsystem)",
  "severity": "high",
  "status": "open",
  "summary": "Linux kernel FUSE readdir cache out-of-bounds write",
  "ticket_id": "CVE-2026-31694"
}