We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Lobsters·Jul 2·5 min read
Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694)
TL;DR
A vulnerability existed in the FUSE (Filesystem in Userspace) readdir cache that allowed unprivileged users to write beyond allocated memory. This was due to a missing bounds check in the code handling directory entries, specifically in the fuse_add_dirent_to_cache() function.
✦ Why It Matters
Engineers should ensure proper bounds checking in their code to prevent similar vulnerabilities.
Key Takeaways
- Implement rigorous bounds checking in kernel code.
- Regularly review and test filesystem implementations for vulnerabilities.
- Stay updated on security patches and CVEs relevant to your systems.
- Educate teams on the implications of memory management errors.
Full Summary
FUSE allows users to create their own filesystems in user space, but a flaw in its readdir cache posed a significant security risk. The vulnerability, identified as CVE-2026-31694, stemmed from a missing bounds check in the fuse_add_dirent_to_cache() function, which failed to verify if a directory entry would fit within the allocated memory page.
This oversight enabled an unprivileged user to write 24 bytes past the end of a kernel page, potentially overwriting critical data like the /etc/passwd file. The bug was reported by Qi Tang and Zijun Hu and was fixed by Samuel Page, with the patch merged on April 20, 2026.
The fix ensures that directory entries are properly checked against memory limits, thus preventing unauthorized privilege escalation. This incident highlights the importance of rigorous bounds checking in kernel-level code to maintain system security.