An exploit for a vulnerability has been dropped, resulting in a LPE, getting to root from an unprivileged user, as long as fusermount3 is installed. The Vuln exists in FUSE.
I’ve been able to replicate on Ubuntu 26, but not on RHEL 9, using the fusermount3 approch. An alternative path with unprivileged namespaces exists but I have not tested it.
Looking for some help with checking if RHEL/CentOS based is also vuln. Thanks!
Blog Post: Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694) – cyberstan
PoC: CVE-2026-31694-POC/Makefile at main · 0xCyberstan/CVE-2026-31694-POC · GitHub