Linux Kernel FUSE Vulnerability Allows Attackers to Gain Root (Administrator) Privileges!

An important security warning has been issued for Linux operating system users and system administrators. A new vulnerability discovered in the FUSE (Filesystem in Userspace) subsystem of the Linux kernel could allow a user with system access to gain administrator (root)-level privileges.

This vulnerability is registered under identifier CVE-2026-31694 and arises from a memory management error in the process of caching directory entries in the FUSE filesystem.

What Is FUSE?

FUSE (Filesystem in Userspace) is a mechanism in the Linux kernel that allows the creation of filesystems that operate in userspace. The core logic of the filesystem runs in a userspace program, while the Linux kernel communicates with this program through the /dev/fuse device.

Today, technologies such as SSHFS, EncFS, AppImage, and many other virtual or network filesystems rely on FUSE.

To speed up file access, the Linux kernel temporarily stores directory entries in the page cache. It is in this mechanism that an error was discovered, leading to a security issue.

How Does the Vulnerability Work?

According to security researchers’ analysis, the issue exists in the fuse_add_dirent_to_cache() function.

This function calculates the size of a directory entry before placing it into the cache. However, in cases where the size of the directory entry exceeds the size of a single memory page, insufficient validation leads to an error.

For example, on systems with a page size of 4 KiB (4096 bytes), a malicious FUSE server could send a directory entry of 4120 bytes. As a result, the extra 24 bytes of the entry are written beyond the allocated boundary — into an adjacent memory page.

This leads to a heap/page cache overflow, creating the possibility of corrupting other kernel data.

How Is the Attack Carried Out?

A Proof-of-Concept demonstrated by researchers showed that the corrupted memory region could affect cached code of programs with the SUID (Set User ID) attribute.

For example, the initial instructions of the /usr/bin/su program could be replaced with malicious code that executes the following system calls:

  • setuid(0)
  • setgid(0)

After these calls are successfully executed, the process automatically gains root user privileges. As a result, the attacker can bypass authentication mechanisms, execute commands with full administrative rights, and gain complete control over the system.

Who Is at Risk?

This vulnerability may affect:

  • systems using the FUSE subsystem of the Linux kernel;
  • devices with a 4 KiB memory page configuration;
  • newer Linux kernel versions that use large readdir buffers;
  • environments where regular users are allowed to run or mount FUSE filesystems.

If unprivileged user namespaces are enabled or if fusermount3 allows regular users to run FUSE filesystems, the likelihood of exploitation significantly increases.

It should also be noted that this vulnerability is not remotely exploitable. The attacker must first have local access to the system or the ability to execute code with regular user privileges.

Potential Consequences

Successful exploitation of this vulnerability could lead to the following risks:

  • obtaining root (administrator) privileges;
  • bypassing security restrictions;
  • modifying or destroying system files;
  • covertly installing malware;
  • stealing confidential data;
  • complete takeover of the operating system.

On servers, cloud infrastructures, container platforms, and multi-user Linux systems, this vulnerability poses a particular threat.

Protection Recommendations

System administrators are advised to take the following measures:

  • install security updates provided by your Linux distribution as soon as possible;
  • regularly monitor kernel updates and apply security patches without delay;
  • restrict users’ ability to mount FUSE filesystems if not necessary;
  • keep setuid permission for fusermount3 only when needed; otherwise, remove it;
  • disable unprivileged user namespaces if not required;
  • regularly monitor system logs and audit records;
  • use only FUSE filesystems and modules from trusted sources;
  • strictly adhere to the principle of least privilege on multi-user servers.

Conclusion

The CVE-2026-31694 vulnerability has once again demonstrated how a seemingly minor memory management error in the Linux kernel’s FUSE subsystem could be transformed into a serious privilege escalation attack.

Although this vulnerability is not remotely exploitable, an attacker with access to the system as a regular user could use it to gain root privileges in a short time. Therefore, administrators managing Linux servers and workstations must review the use of FUSE services, install security updates in a timely manner, and restrict user privileges as much as possible.

Some of the most effective security measures in cybersecurity include regularly updating the operating system and its components, adhering to the principle of least privilege, and continuously monitoring system activity.