A missing bounds check in the Linux kernel FUSE readdir cache allows a malicious FUSE server to overflow a page-cache page by 24 bytes. In fs/fuse/readdir.c, fuse_add_dirent_to_cache() computes the serialized directory-entry size from the server-controlled namelen field and copies it into a single page-cache page. The check offset + reclen > PAGE_SIZE only handles records that do not fit in the remaining space of the current page; it does not reject records larger than PAGE_SIZE itself. After the FUSE_NAME_MAX increase to PATH_MAX-1 (4095) in Linux 6.16 (commit 27992ef80770d), a FUSE daemon can return a dirent with namelen=4095, producing a 4120-byte record that overflows a 4 KiB page by 24 bytes into the adjacent kernel page. This can be exploited for unprivileged local privilege escalation by corrupting the page-cache copy of /etc/passwd. Affected versions are reachable from v6.16 through v7.0-rc and stable branches before their respective fixes. Reproduction uses the public PoC at https://github.com/0xCyberstan/CVE-2026-31694-POC inside a QEMU/KVM VM running a vulnerable kernel.