This vulnerability is in the Linux kernel’s FUSE filesystem. The fuse_add_dirent_to_cache() routine copies directory entries received from a FUSE server into page‑cache memory without ensuring that the entry fits within a single 4 KiB page. A malicious server can send a name length of 4095 bytes, causing the serialized record to be 4120 bytes. The resulting memcpy() writes past the end of the page buffer by 24 bytes into the next kernel page, corrupting kernel memory. Depending on the context, this can trigger a kernel crash, disrupt data integrity, or provide a ground for privilege escalation.

All Linux kernel releases that still contain the original fuse_add_dirent_to_cache() implementation are vulnerable. The patch that rejects oversized dirents is present in the commit referenced by the advisory; any distribution shipping kernels that have not incorporated this commit remains affected, regardless of other updates.

The CVSS score of 7.0 marks the issue as high severity. The EPSS score is unavailable and it is not listed in CISA KEV, indicating limited public exploitation data. Exploitation requires control of a FUSE server that a vulnerable system mounts or the ability to mount a deleterious FUSE filesystem locally. After mounting, the attacker can trigger the overflow by issuing a readdir operation. The attack surface is therefore limited to environments where FUSE mounts expose remote or untrusted servers.