CVE-2026-31694: Verified Repro With Script Download

CVE-2026-31694 is an out-of-bounds write in the Linux kernel FUSE readdir cache. A malicious userspace FUSE daemon can return a FUSE_READDIR entry with a server-controlled namelen=4095; the kernel serializes this as a 4120-byte directory entry and copies it into a single 4096-byte readdir cache page. The missing reclen > PAGE_SIZE validation lets the final 24 bytes spill into the next physical page. In this run, the vulnerability was reproduced end-to-end in a QEMU guest using the real Linux kernel/FUSE code path, and the exploit chain was extended beyond KASAN-visible corruption: an unprivileged uid 1000 process changed the page-cache contents of a root-owned, read-only /etc/passwd file to a passwordless-root line. A fixed fuse.ko negative control rejected the oversized dirent and left /etc/passwd unchanged.

• Package/component affected: Linux kernel FUSE subsystem, specifically fs/fuse/readdir.c in the readdir cache path (fuse_add_dirent_to_cache()).
• Affected versions: The issue is reachable after the FUSE name length increase to PATH_MAX - 1 / 4095, reported for Linux v6.16 through v7.0-rc and affected stable branches before the fix.
• Risk level and consequences: High. A local attacker able to run a malicious FUSE daemon can obtain a constrained but attacker-controlled 24-byte overwrite into an adjacent physical page. When groomed onto a page-cache page for a privileged file such as /etc/passwd, the primitive bypasses filesystem write permissions and can produce local privilege escalation semantics.

Impact Parity

• Disclosed/claimed maximum impact: Unprivileged local privilege escalation via page-cache corruption of /etc/passwd.
• Reproduced impact from this run: Full local privilege-escalation primitive. The script boots a non-sanitized kernel in QEMU, uses the real FUSE kernel path, drops the exploit process to uid/gid 1000 before attacker-controlled READDIR replies and target corruption, verifies direct writes to /etc/passwd fail with Read-only file system, then shows /etc/passwd page-cache contents changed from root:x:0:0:root:/root:/bin/sh to root::0:0:x:.:. Two vulnerable attempts succeeded, and two fixed negative-control attempts left /etc/passwd unchanged.
• Parity: full.
• Not demonstrated: The proof stops after demonstrating the root-level page-cache corruption effect. It does not spawn an interactive root shell, but the demonstrated primitive is the disclosed LPE mechanism: an unprivileged attacker changes the trusted cached contents of a root-owned passwd file to a passwordless-root entry without write permission.

Root Cause

fuse_add_dirent_to_cache() computes a serialized FUSE dirent size from a FUSE-server-controlled name length and copies that many bytes into a single page-cache page. The vulnerable logic only checks whether the record fits in the remaining space of the current page and, if not, advances to a fresh page with offset zero. It does not reject a record whose serialized length is larger than one page.

Conceptually, the vulnerable flow is:

size_t reclen = FUSE_DIRENT_SIZE(dirent);   // 4120 for namelen=4095
...
offset = size & ~PAGE_MASK;
if (offset + reclen > PAGE_SIZE) {
    index++;
    offset = 0;
}
...
memcpy(addr + offset, dirent, reclen);      // copies 4120 bytes into 4096-byte page

For namelen=4095, FUSE_DIRENT_ALIGN(24 + 4095) is 4120. At offset=0, the kernel still performs memcpy(..., 4120) into a 4096-byte page, spilling 24 bytes into the next physical page. The exploit controls those trailing bytes and uses page allocator grooming to place the first page of /etc/passwd in the adjacent page frame.

The fix is to reject oversized dirents before adding them to the readdir cache, e.g. by adding a guard equivalent to:

if (reclen > PAGE_SIZE)
    return;

The ticket identifies upstream fix commit 51a8de6c50bf947c8f534cd73da4c8f0a13e7bed (fuse: reject oversized dirents in page cache). The reproduction script builds the vulnerable module without this guard and the fixed module with this guard as the negative control.

Reproduction Steps

1. Run bundle/repro/reproduction_steps.sh from the repository workspace, or run it with PRUVA_ROOT=/path/to/bundle.
2. The script:
   • Reuses the prepared Linux source/build cache when available.
   • Builds a non-sanitized Linux kernel and vulnerable fuse.ko from the real source.
   • Builds a fixed fuse.ko with the reclen > PAGE_SIZE guard.
   • Builds bundle/repro/fuse_passwd_lpe from bundle/repro/fuse_passwd_lpe.c, a public-PoC-derived malicious FUSE daemon that speaks the real FUSE protocol.
   • Creates a small active ext4 root filesystem containing a root-owned, mode 0444 /etc/passwd.
   • Boots QEMU twice with the vulnerable module and twice with the fixed module.
   • In each guest, root performs only setup/module loading; the exploit drops to uid/gid 1000 before attacker-controlled FUSE replies and /etc/passwd targeting.
3. Expected evidence:
   • Vulnerable attempts show PAGE_CACHE_CORRUPTION_CONFIRMED uid=1000 target=/etc/passwd, Direct write check as uid 1000: Read-only file system, and INIT_AFTER=root::0:0:x:.:.
   • Fixed attempts show INIT_RESULT_FIXED_REJECTED_OVERSIZED_DIRENT and INIT_AFTER=root:x:0:0:root:/root:/bin/sh with no page-cache-corruption confirmation.

Evidence

Primary current-run artifacts:

• bundle/repro/reproduction_steps.sh — self-contained reproduction script.
• bundle/repro/runtime_manifest.json — runtime evidence manifest written by the script.
• bundle/repro/validation_verdict.json — structured verdict written by the script.
• bundle/logs/reproduction_steps.log — consolidated build and proof log.
• bundle/logs/qemu_lpe_vuln_attempt1.log
• bundle/logs/qemu_lpe_vuln_attempt2.log
• bundle/logs/qemu_lpe_fixed_attempt1.log
• bundle/logs/qemu_lpe_fixed_attempt2.log
• bundle/repro/fuse_passwd_lpe.c and bundle/repro/fuse_passwd_lpe — malicious FUSE daemon/helper used in the guest.
• bundle/repro/fuse-nokasan-vuln.ko and bundle/repro/fuse-nokasan-fixed.ko — vulnerable and fixed FUSE modules used for comparison.

Key vulnerable evidence from the second verified run in bundle/logs/reproduction_steps.log:

Primary proof build is non-sanitized: CONFIG_KASAN is disabled
INIT_ROLE=vuln
INIT_KERNEL=6.18.18
INIT_ROOTFS_ACTIVE=/dev/vda
INIT_BEFORE=root:x:0:0:root:/root:/bin/sh
[+] Running exploit logic as uid=1000 gid=1000 target=/etc/passwd
[+] Direct write check as uid 1000: Read-only file system
[+] Warmup: 3/5 (60%)
[*] LPE 1/200 ... [+] CORRUPTED /etc/passwd first_line=root::0:0:x:.:
HIT!
[+] PAGE_CACHE_CORRUPTION_CONFIRMED uid=1000 target=/etc/passwd
INIT_EXPLOIT_RC=0
INIT_AFTER=root::0:0:x:.:
INIT_RESULT_PAGE_CACHE_LPE_CONFIRMED
VULNERABLE attempt 1: unprivileged page-cache corruption of /etc/passwd confirmed

The second vulnerable attempt produced the same successful markers:

INIT_ROLE=vuln
INIT_BEFORE=root:x:0:0:root:/root:/bin/sh
[+] Direct write check as uid 1000: Read-only file system
[+] PAGE_CACHE_CORRUPTION_CONFIRMED uid=1000 target=/etc/passwd
INIT_AFTER=root::0:0:x:.:
INIT_RESULT_PAGE_CACHE_LPE_CONFIRMED
VULNERABLE attempt 2: unprivileged page-cache corruption of /etc/passwd confirmed

Fixed negative-control evidence:

INIT_ROLE=fixed
INIT_BEFORE=root:x:0:0:root:/root:/bin/sh
[+] Running exploit logic as uid=1000 gid=1000 target=/etc/passwd
[+] Direct write check as uid 1000: Read-only file system
[+] Warmup: 0/5 (0%)
[-] No warmup hits.
INIT_EXPLOIT_RC=1
INIT_AFTER=root:x:0:0:root:/root:/bin/sh
INIT_RESULT_FIXED_REJECTED_OVERSIZED_DIRENT
FIXED attempt 1: oversized dirent failed closed; /etc/passwd unchanged

The second fixed attempt also failed closed and left /etc/passwd unchanged. The script summary was:

Vulnerable page-cache-corruption attempts: 2/2
Fixed negative-control attempts: 2/2
CVE-2026-31694 CONFIRMED: non-sanitized vulnerable kernel permits uid 1000 to corrupt the page-cache contents of root-owned read-only /etc/passwd; fixed module blocks it.

Recommendations / Next Steps

• Apply the upstream fix that rejects dirents whose serialized length exceeds PAGE_SIZE before caching them.
• Backport the reclen > PAGE_SIZE guard to all supported kernels that include the FUSE name length increase and have vulnerable readdir cache logic.
• Add regression tests for FUSE READDIR replies with maximum name lengths, including records that exceed a page after alignment.
• Consider hardening and auditing other page-cache or direct-map write paths where attacker-controlled data can cross a page boundary into an adjacent physical page.
• Treat KASAN-only testing as insufficient for this exploit class: the primary exploit target is a page-cache page and the important observable impact is privileged file-content corruption in the kernel page cache.

Additional Notes

• Idempotency confirmation: bundle/repro/reproduction_steps.sh was executed twice consecutively after the shell bug was fixed. Both runs exited 0 and produced the same 2/2 vulnerable and 2/2 fixed outcomes.
• Primary proof mode: The proof is intentionally non-sanitized (CONFIG_KASAN disabled) and uses product/runtime kernel execution through QEMU and the real FUSE boundary.
• Privilege boundary: The process opens /dev/fuse and mounts during privileged harness setup, then calls setresgid(1000,1000,1000) and setresuid(1000,1000,1000) before sending malicious FUSE READDIR replies and grooming /etc/passwd.
• Scope: The proof demonstrates the disclosed LPE primitive by changing the trusted page-cache contents of root-owned /etc/passwd. It does not persist the change to disk or spawn an interactive root shell, to keep the run deterministic and self-contained.

A materially distinct alternate trigger was confirmed on the vulnerable kernel: a malicious FUSE daemon can negotiate FUSE_DO_READDIRPLUS and return a FUSE_READDIRPLUS response containing a struct fuse_direntplus whose embedded struct fuse_dirent has namelen=4095. The kernel parses this through parse_dirplusfile(), then calls the same fuse_emit() and fuse_add_dirent_to_cache() sink used by ordinary FUSE_READDIR, producing the same 4120-byte copy into a 4096-byte readdir cache page and the same unprivileged /etc/passwd page-cache corruption primitive. This is not a bypass of the tested fix: the fixed fuse.ko adds a sink-level reclen > PAGE_SIZE guard in fuse_add_dirent_to_cache(), so it blocks both the original FUSE_READDIR path and the FUSE_READDIRPLUS alternate parser path.

Fix Coverage / Assumptions

The effective fix relies on the invariant that no serialized directory entry larger than one page may be copied into the FUSE readdir cache. It enforces that invariant at the common sink, fs/fuse/readdir.c:fuse_add_dirent_to_cache(), immediately after computing:

size_t reclen = FUSE_DIRENT_SIZE(dirent);

The tested fixed module adds the equivalent of:

if (reclen > PAGE_SIZE)
    return;

This explicitly covers every caller that reaches the cache insertion sink through fuse_emit(), including:

• parse_dirfile() for FUSE_READDIR replies, and
• parse_dirplusfile() for FUSE_READDIRPLUS replies.

The fix does not validate FUSE_DIRENTPLUS_SIZE() itself against PAGE_SIZE; however, the overflow root cause is not the larger wire-format direntplus record. The overflow occurs when the embedded struct fuse_dirent is passed to fuse_add_dirent_to_cache() and copied as FUSE_DIRENT_SIZE(dirent). Because the guard is at that common sink, it closes this alternate path. The fix assumption appears complete for this specific root cause: all readdir-cache insertions flow through fuse_add_dirent_to_cache().

Variant / Alternate Trigger

The tested alternate trigger is FUSE_READDIRPLUS instead of ordinary FUSE_READDIR.

Exact runtime entry/message path:

1. A local attacker-controlled FUSE daemon opens /dev/fuse and mounts a FUSE filesystem in the VM harness.
2. During FUSE_INIT, the daemon advertises FUSE_DO_READDIRPLUS.
3. During getdents64() on a trigger directory, the kernel issues FUSE_READDIRPLUS.
4. The malicious daemon replies with a struct fuse_direntplus whose embedded dirent.namelen is 4095.
5. The kernel parses the response in parse_dirplusfile() and calls fuse_emit().
6. fuse_emit() calls fuse_add_dirent_to_cache() because FOPEN_CACHE_DIR is set.
7. Vulnerable fuse_add_dirent_to_cache() copies FUSE_DIRENT_SIZE(dirent) == 4120 bytes into one 4096-byte page.

Specific code anchors:

• fs/fuse/readdir.c:32-88 — fuse_add_dirent_to_cache() computes reclen, advances to a new page if offset + reclen > PAGE_SIZE, then performs memcpy(addr + offset, dirent, reclen).
• fs/fuse/readdir.c:114-123 — fuse_emit() calls fuse_add_dirent_to_cache() when FOPEN_CACHE_DIR is set.
• fs/fuse/readdir.c:293-326 — parse_dirplusfile() parses FUSE_READDIRPLUS records and invokes fuse_emit() with the embedded struct fuse_dirent.
• fs/fuse/readdir.c:334-377 — fuse_readdir_uncached() selects FUSE_READDIRPLUS when fuse_use_readdirplus() is true.

The stage-specific reproducer is bundle/vuln_variant/fuse_readdirplus_lpe.c. It differs from the prior FUSE_READDIR proof by advertising FUSE_DO_READDIRPLUS, handling opcode FUSE_READDIRPLUS, building a struct fuse_direntplus response, and treating any fallback ordinary FUSE_READDIR as an error for evidence clarity.

• Package/component affected: Linux kernel FUSE subsystem, fs/fuse/readdir.c readdir cache path.
• Affected versions as tested: vulnerable module built from the prepared Linux 6.18.18 source snapshot without the reclen > PAGE_SIZE guard; fixed negative-control module built from the same source/config with the guard inserted.
• Risk level and consequences: High on vulnerable builds. The alternate FUSE_READDIRPLUS path gives the same local privilege-escalation primitive as the parent issue: an unprivileged attacker-controlled FUSE daemon can corrupt the page-cache contents of a root-owned, read-only /etc/passwd file.

Impact Parity

• Disclosed/claimed maximum impact for the parent: unprivileged local privilege escalation via page-cache corruption of /etc/passwd.
• Reproduced impact from this variant run: full LPE primitive on the vulnerable module through FUSE_READDIRPLUS: the exploit drops to uid/gid 1000 before malicious replies and target corruption, direct append to /etc/passwd fails with Read-only file system, and /etc/passwd page-cache contents change to root::0:0:x:.:.
• Parity: full on the vulnerable alternate trigger; none on the fixed module because the tested fix blocks the alternate trigger.
• Not demonstrated: an interactive root shell was not spawned. The proof stops at deterministic page-cache corruption of /etc/passwd, matching the parent LPE primitive.

Root Cause

The same underlying bug can be reached because FUSE_READDIRPLUS eventually reuses the same cache insertion function as ordinary FUSE_READDIR. parse_dirplusfile() computes the wire record length using FUSE_DIRENTPLUS_SIZE(direntplus) to parse a struct fuse_direntplus, but when it emits a directory entry it passes the embedded struct fuse_dirent to fuse_emit(). fuse_emit() then calls fuse_add_dirent_to_cache(), which computes FUSE_DIRENT_SIZE(dirent) from the embedded attacker-controlled namelen and performs the vulnerable copy.

For namelen=4095, FUSE_DIRENT_SIZE(dirent) is 4120. In the vulnerable sink, the existing check only moves the insertion offset to the start of the next page when offset + reclen > PAGE_SIZE; it does not reject reclen > PAGE_SIZE. A 4120-byte memcpy() therefore writes 24 bytes beyond the end of the target cache page.

The ticket identifies the upstream fix as 51a8de6c50bf947c8f534cd73da4c8f0a13e7bed (fuse: reject oversized dirents in page cache). The tested fixed module applies the same sink-level guard, and runtime evidence shows that this guard blocks the FUSE_READDIRPLUS alternate trigger.

Reproduction Steps

1. Run bundle/vuln_variant/reproduction_steps.sh from the workspace, or set PRUVA_ROOT=/path/to/bundle and run it from any directory.
2. The script:
   • builds bundle/vuln_variant/fuse_readdirplus_lpe from the stage-specific source,
   • boots the prepared non-KASAN kernel in QEMU,
   • tests the FUSE_READDIRPLUS variant against the vulnerable fuse.ko,
   • tests the same variant against the fixed fuse.ko, and
   • writes logs under bundle/logs/vuln_variant/.
3. Expected evidence:
   • Vulnerable run: received FUSE_READDIRPLUS, PAGE_CACHE_CORRUPTION_CONFIRMED uid=1000 target=/etc/passwd, VARIANT_AFTER=root::0:0:x:.:, and VARIANT_RESULT_READDIRPLUS_LPE_CONFIRMED.
   • Fixed run: received FUSE_READDIRPLUS, VARIANT_AFTER=root:x:0:0:root:/root:/bin/sh, and VARIANT_RESULT_FIXED_REJECTED_READDIRPLUS_OVERSIZED_DIRENT, with no PAGE_CACHE_CORRUPTION_CONFIRMED.

Evidence

Current-run artifacts:

• bundle/vuln_variant/reproduction_steps.sh — stage-specific vulnerable/fixed variant test.
• bundle/vuln_variant/fuse_readdirplus_lpe.c — malicious READDIRPLUS FUSE daemon/helper.
• bundle/vuln_variant/runtime_manifest.json — runtime stack and proof artifact manifest.
• bundle/logs/vuln_variant/readdirplus_variant.log — consolidated current-run evidence.
• bundle/logs/vuln_variant/qemu_readdirplus_vuln.log — vulnerable QEMU evidence.
• bundle/logs/vuln_variant/qemu_readdirplus_fixed.log — fixed negative-control evidence.

Key vulnerable evidence from the idempotency run:

VARIANT_ROLE=vuln
VARIANT_KERNEL=6.18.18
VARIANT_BEFORE=root:x:0:0:root:/root:/bin/sh
[fuse] INIT: advertising FUSE_DO_READDIRPLUS for variant path
[fuse] received FUSE_READDIRPLUS offset=0; holding reply for grooming
[fuse] replying to FUSE_READDIRPLUS with namelen=4095 plus_reclen=4248 embedded_dirent_reclen=4120
[+] Direct write check as uid 1000: Read-only file system
[+] CORRUPTED /etc/passwd first_line=root::0:0:x:.:
[+] PAGE_CACHE_CORRUPTION_CONFIRMED uid=1000 target=/etc/passwd
VARIANT_EXPLOIT_RC=0
VARIANT_AFTER=root::0:0:x:.:
VARIANT_RESULT_READDIRPLUS_LPE_CONFIRMED

Key fixed evidence:

VARIANT_ROLE=fixed
VARIANT_KERNEL=6.18.18
VARIANT_BEFORE=root:x:0:0:root:/root:/bin/sh
[fuse] INIT: advertising FUSE_DO_READDIRPLUS for variant path
[fuse] received FUSE_READDIRPLUS offset=0; holding reply for grooming
[fuse] replying to FUSE_READDIRPLUS with namelen=4095 plus_reclen=4248 embedded_dirent_reclen=4120
[+] Warmup: 0/5 (0%)
[-] No warmup hits.
VARIANT_EXPLOIT_RC=1
VARIANT_AFTER=root:x:0:0:root:/root:/bin/sh
VARIANT_RESULT_FIXED_REJECTED_READDIRPLUS_OVERSIZED_DIRENT

Both mandatory verification runs completed without crashing. Both returned script exit code 1, which is the designed outcome for “alternate trigger on vulnerable module, no fixed-version bypass.”

Recommendations / Next Steps

• Keep the fix at the common cache insertion sink (fuse_add_dirent_to_cache()), not only in the ordinary FUSE_READDIR parser, because FUSE_READDIRPLUS and any future parser that calls fuse_emit() share the same sink.
• Add regression coverage for both FUSE_READDIR and FUSE_READDIRPLUS replies with namelen=4095 and FOPEN_CACHE_DIR enabled.
• Consider adding a defensive WARN/test assertion that every readdir-cache insertion satisfies FUSE_DIRENT_SIZE(dirent) <= PAGE_SIZE before copying.
• Audit future FUSE directory-entry emitters for direct calls to fuse_add_dirent_to_cache() or equivalent page-cache serialization logic.

Additional Notes

• Idempotency confirmation: bundle/vuln_variant/reproduction_steps.sh was executed twice consecutively. Both runs completed cleanly, reproduced the FUSE_READDIRPLUS alternate trigger on the vulnerable module, and showed the fixed module blocking it.
• Threat model scope: The Linux kernel documentation treats exploitable kernel bugs as security bugs and routes them to security@kernel.org. This variant crosses the same local kernel trust boundary as the parent: an unprivileged local process controls a FUSE server response that is consumed by privileged kernel code.
• Conclusion: This is a validated alternate vulnerable-version trigger, not a patch bypass. The tested sink-level fix is complete for the discovered FUSE_READDIRPLUS path.