Linux kernel FUSE oversized dirent page-cache overflow

CVE-2026-31694 is a Linux kernel memory-corruption vulnerability in the FUSE subsystem, specifically in fuse_add_dirent_to_cache(). The function computes a serialized directory-entry size from a server-controlled namelen field and copies the resulting dirent into a single page-cache page used for the readdir cache. The vulnerable logic verified only whether the dirent fit in the remaining space of the current page and, if necessary, advanced to a fresh page, but it did not verify whether the dirent itself exceeded PAGE_SIZE. A malicious FUSE server can therefore return an oversized dirent, such as namelen=4095, producing a serialized record size of 4120 bytes. On systems with 4 KiB pages, this causes memcpy() to write 24 bytes past the end of the cache page into the following kernel page. The fix rejects directory entries that cannot fit within a single page before copying them into the readdir cache.