In the Linux kernel the fuse_add_dirent_to_cache routine copies directory entries from a FUSE server into page‑cache memory without ensuring that a single entry fits within a 4 KiB page. A server can supply a namelen of 4095, producing a serialized record of 4120 bytes. The memcpy operation then writes 24 bytes past the end of the cache page, corrupting the subsequent kernel page.

All Linux kernel releases that have not incorporated the commit that rejects oversized dirents are vulnerable. Distributions shipping kernels that lack this patch remain affected regardless of other updates.

The CVSS score of 7.8 classifies the issue as high severity. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating limited known exploitation. Based on the description, it is inferred that exploitation requires a FUSE server that the vulnerable system mounts or the attacker having the ability to mount a malicious local FUSE filesystem. After the mount, a readdir operation can trigger the overflow, potentially leading to kernel memory corruption and a system crash or data corruption.