Executive brief
A vulnerability was identified in the Linux kernel's FUSE (Filesystem in Userspace) implementation where certain cache operations were incorrectly allowed on directories. This could allow a malicious filesystem driver to corrupt internal kernel memory or trigger system warnings by injecting unexpected data into the directory cache. The fix ensures these operations are only permitted on regular files, maintaining the integrity of the system's directory management.
Technical details
In the Linux kernel FUSE implementation, the FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE operations allow a FUSE daemon to directly manipulate pagecache contents. When FOPEN_CACHE_DIR is enabled, the pagecache is utilized for kernel-internal directory cache storage. Because the kernel expects specific data structures in this cache, allowing a userspace daemon to inject arbitrary data via these notify operations can trigger a WARN_ON() in fuse_parse_cache() or lead to undefined behavior. The vulnerability is resolved by adding checks in fs/fuse/dev.c to ensure the target inode is a regular file (S_ISREG) before proceeding with pagecache notification operations, returning -EINVAL otherwise.
Affected products
- Linux Linux Kernel 4.20 to 6.13
Timeline
- 2026-05-19: disclosed: Vulnerability reported and patch authored by Jann Horn
- 2026-06-19: patched: Patch committed to stable kernel branches
- 2026-06-25: advisory: CVE published and NVD record created
References
- https://git.kernel.org/stable/c/12df4cfa738aefff21756728e91056d7defb0fe6
- https://git.kernel.org/stable/c/15487f98863dc7156ed43c5be26d478beb82ba35
- https://git.kernel.org/stable/c/99c317d7f8b7bbf3de16d20a01f363e390114cea
- https://git.kernel.org/stable/c/9c954499d43aefac01c5dfb57a82b13d2dcf4b94
- https://git.kernel.org/stable/c/9dbf1b2fadfc6c40805631d8a8276d1639fc9ab6
- https://git.kernel.org/stable/c/bd23fa0c16c5c86e5b7713224ffbb87d9db81cca
- https://git.kernel.org/stable/c/dd92773d4d9cea010474eb08a5133c14ff6ab53a