Linux kernel FUSE: a malicious server overflows the readdir cache page by 24 bytes

Impact

fuse_add_dirent_to_cache sizes a dirent from the server-controlled namelen and only checks whether it fits in the remaining space of the current page, never whether it exceeds PAGE_SIZE at all. A FUSE server returning namelen=4095 produces a 4120-byte record, and on 4 KiB-page systems the memcpy writes 24 bytes past the page-cache page into the next kernel page. GPU nodes lean on FUSE for dataset and model access - object-store mounts, checkpoint and image layers - and anywhere unprivileged FUSE mounts are permitted, a tenant that can run its own FUSE server gets a controlled kernel heap write from inside a container. Siemens ships the affected kernel in the SIMATIC S7-1500 TM MFP Linux subsystem.

Who can reach it

Local. Any user who can mount a FUSE filesystem backed by a server they control, which includes container workloads on hosts that allow unprivileged user-namespace FUSE mounts. No further authentication is needed once the mount exists.

What to do

Update to a stable kernel carrying the fix; FUSE is core kernel on most distro builds, so this is a drain and reboot per node. As an interim mitigation, disallow unprivileged FUSE mounts for tenant workloads (no user-namespace FUSE, no fuse device in the pod) so only operator-controlled servers can feed the readdir cache. Siemens advisory SSA-784472 covers the SIMATIC product line.

References

Related entries

• Linux kernel xen/privcmd: partial munmap of a privcmd mapping leads to a double free (XSA-487)CVE-2026-31787 · Linux kernel Xen privcmd driver (VMA splitting on hypercall mappings)High
• uutils coreutils: chroot --userspec resolves the user inside the new root, loading attacker NSS modules as rootCVE-2026-35368 · uutils coreutils `chroot --userspec` (NSS module load after chroot)High
• sudo: failed setuid/setgid/setgroups before running the mailer is non-fatal, allowing privilege escalationCVE-2026-35535 · sudo (privilege drop before invoking the mailer)High
• QEMU: guest-triggered out-of-bounds write when a physical memory map returns shortCVE-2026-3842 · QEMU (cpu_physical_memory_map short-mapping handling)High
• Linux kernel BPF verifier: atomic-fetch precision gap lets equivalent-looking states be prunedCVE-2026-43009 · Linux kernel BPF verifier (precision backtracking for atomic fetch instructions)High
• Linux kernel sockmap: use-after-free of sk->sk_socket when an AF_UNIX peer is orphanedCVE-2026-43016 · Linux kernel BPF sockmap (sk_psock_verdict_data_ready)High