Linux FUSE Vulnerability Allows Unprivileged Users to Pop a Root Shell

A FUSE directory-caching bug (CVE-2026-31694) permits an unprivileged user who can mount a FUSE filesystem to craft an oversized directory entry that overflows a 4 KiB page by 24 bytes, enabling reliable local privilege escalation by corrupting the page cache of a cached SUID binary (demonstrated against /usr/bin/su on vulnerable kernels). The flaw affects kernels from v6.16-rc1 onward (where the FUSE readdir buffer was increased), has an upstream patch that prevents caching dirents larger than PAGE_SIZE, and administrators are urged to apply kernel updates and reduce FUSE/unprivileged-mount exposure.