Status: UPDATED | Advisory ID: CVE-2026-31694
| CVE | CVE-2026-31694 |
| CVSS Score / Version | |
| Updated | 2026-10-15 |
| CVSS Vector | |
| CVSS Prose | |
| Affected products | |
| Exploitation prediction (EPSS) |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| Linux | Linux Kernel | ||
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem |
| Subsystems | Controllers & Field I/O, OT Supporting Infrastructure |
| Sectors | All Sectors |
In the Linux kernel, the following vulnerability has been resolved:
fuse: reject oversized dirents in page cache
fuse_add_dirent_to_cache() computes a serialized dirent size from the
server-controlled namelen field and copies the dirent into a single
page-cache page. The existing logic only checks whether the dirent fits
in the remaining space of the current page and advances to a fresh page
if not. It never checks whether the dirent itself exceeds PAGE_SIZE.
As a result, a malicious FUSE server can return a dirent with
namelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB
page systems this causes memcpy() to overflow the cache page by 24 bytes
into the following kernel page.
Reject dirents that cannot fit in a single page before copying them into
the readdir cache. (NVD)
Monitor Linux's and Siemens's web pages for any future patch releases.
| Source | Reference |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-31694 |
| CVE | https://www.cve.org/CVERecord?id=CVE-2026-31694 |