CVE-2026-31694 Passive Scanner

A passive Linux host assessment tool for CVE-2026-31694, a FUSE readdir-cache out-of-bounds write in the Linux kernel.

The scanner evaluates the running kernel, FUSE exposure, local package metadata, kernel source evidence, execution environment, and operating-system family. When the host may be affected, it produces a mitigation guide tailored to the detected distribution.

Author: Aung Myat Thu [w01f]

Table of Contents

• Overview
• Vulnerability Summary
• Security Model
• Features
• Requirements
• Installation
• Usage
• Command-Line Options
• Assessment Workflow
• Verdicts
• Exit Codes
• Detection Sources
• Distribution Support
• Mitigation Generation
• Container and WSL Behavior
• Report Formats
• Automation and Integration
• Operational Guidance
• Limitations
• Troubleshooting
• References

Overview

cve_2026_31694_scanner.py is a local, non-exploit vulnerability assessment utility.

It does not confirm the vulnerability by triggering the affected FUSE code path. Instead, it combines multiple passive indicators:

• running kernel release;
• upstream fixed-version baselines;
• current memory page size;
• CONFIG_FUSE_FS kernel configuration;
• registered FUSE filesystem types;
• /dev/fuse presence and current-user access;
• FUSE mount helper availability;
• active FUSE mounts;
• installed kernel source inspection;
• kernel package ownership;
• local package changelog evidence;
• cached package update metadata;
• installed-versus-running kernel comparison;
• distribution and package-manager detection;
• container, virtual-machine, and WSL detection.

The result is an exposure assessment, not an exploit-based proof.

Vulnerability Summary

CVE-2026-31694 affects the Linux kernel FUSE readdir cache.

The vulnerable logic calculates the serialized size of a directory entry from a server-controlled name length and copies the record into a single page-cache page. A directory entry with a name length of 4095 can produce a serialized size of 4120 bytes.

On a system using 4096-byte pages, that record exceeds one page by 24 bytes.

The upstream correction rejects directory records that cannot fit inside a single page before the cache copy occurs.

Affected component

fs/fuse/readdir.c
fuse_add_dirent_to_cache()

Scanner baseline data

The scanner contains the following upstream stable fixed baselines:

These versions are used as one assessment input. They are not treated as the only source of truth because distribution vendors may backport the correction while retaining an older upstream version number.

Security Model

The scanner is designed to avoid invoking the vulnerable operation.

The scanner does not

• mount a FUSE filesystem;
• open or communicate with /dev/fuse;
• start a FUSE server;
• submit crafted directory records;
• allocate memory for page-placement testing;
• groom kernel allocators;
• modify /etc/passwd;
• change kernel configuration;
• load or unload kernel modules;
• modify /dev/fuse permissions;
• install or remove packages;
• reboot the system;
• attempt privilege escalation.

The scanner may

• read files under /proc, /boot, /lib/modules, /usr/lib/modules, /usr/src, and package metadata directories;
• execute bounded, read-only package queries;
• inspect active mounts and filesystem registration;
• write a report only when --output is explicitly supplied;
• print mitigation commands for administrator review.

Mitigation commands are documentation output. They are never executed automatically.

Features

Host and kernel identification

• Reads platform.release() and parses the upstream-style kernel version.
• Reads /etc/os-release or /usr/lib/os-release.
• Detects CPU architecture and memory page size.
• Identifies whether the scanned kernel belongs to the current operating system.

FUSE exposure assessment

• Reads CONFIG_FUSE_FS from available kernel configuration sources.
• Detects built-in FUSE support and loadable-module configurations.
• Reads /proc/filesystems.
• Checks /dev/fuse metadata and current-user read/write access.
• Locates fusermount3 or fusermount.
• Parses active FUSE mounts from /proc/self/mountinfo.

Patch evidence

• Compares the running version against upstream fixed baselines.
• Searches installed kernel source for the oversized-record guard.
• Checks local RPM or Debian package changelogs for:
  • CVE-2026-31694;
  • the upstream patch title.

Package and reboot state

• Attempts to identify the package owning the running kernel.
• Queries local package-manager metadata without refreshing repositories.
• Detects a newer installed kernel when the host environment is authoritative.
• Checks /var/run/reboot-required where applicable.

Environment awareness

• Detects Docker-compatible containers.
• Detects Podman-compatible containers.
• Detects container-related cgroups.
• Detects WSL.
• Detects virtual machines using systemd-detect-virt when available.

Reporting

• Human-readable text output.
• Machine-readable JSON output.
• Markdown report output.
• Mitigation-only output.
• Optional file output.
• Meaningful process exit codes.

Requirements

Required

• Linux for kernel assessment.
• Python 3.9 or newer.
• Read access to normal system metadata.

The scanner uses only the Python standard library.

Optional commands

Additional evidence is collected when the following tools are present:

Root privileges are not required for the normal scan.

Some evidence may be unavailable to an unprivileged account because of system-specific file permissions.

Installation

Place the scanner in a working directory:

chmod +x cve_2026_31694_scanner.py

Run it directly:

./cve_2026_31694_scanner.py

Or invoke it with Python:

python3 cve_2026_31694_scanner.py

No Python package installation is required.

Usage

Standard assessment

python3 cve_2026_31694_scanner.py

JSON output

python3 cve_2026_31694_scanner.py --format json

The compatibility alias below produces the same format:

python3 cve_2026_31694_scanner.py --json

Markdown report

python3 cve_2026_31694_scanner.py --format markdown

Save a report

python3 cve_2026_31694_scanner.py \
  --format markdown \
  --output cve-2026-31694-report.md

Print only remediation guidance

python3 cve_2026_31694_scanner.py --mitigation-only

Skip package update queries

python3 cve_2026_31694_scanner.py --no-package-query

Always return success after reporting

python3 cve_2026_31694_scanner.py --no-exit-status

This option is useful when collecting reports without allowing vulnerability status to fail an orchestration job.

Command-Line Options

Assessment Workflow

The scanner evaluates evidence in the following order.

1. Operating-system and environment detection

The scanner determines:

• whether the operating system is Linux;
• distribution ID and family;
• package manager;
• whether the process is running on:
  • a normal host;
  • a virtual machine;
  • a container;
  • WSL.

Environment detection changes the interpretation of package and reboot data.

For example, a container can see the host kernel but normally cannot determine the host kernel package from the container filesystem.

2. FUSE configuration

The scanner searches for a running-kernel configuration in:

/proc/config.gz
/boot/config-$(uname -r)
/lib/modules/$(uname -r)/build/.config
/usr/lib/modules/$(uname -r)/build/.config

It evaluates:

CONFIG_FUSE_FS=y
CONFIG_FUSE_FS=m
CONFIG_FUSE_FS is not set

Interpretation:

3. Runtime exposure

The scanner checks:

/proc/filesystems
/dev/fuse
PATH for fusermount3 or fusermount
/proc/self/mountinfo

The absence of /dev/fuse or fusermount3 reduces immediate usability from the current environment, but does not prove that the kernel is patched.

4. Page-size geometry

The documented oversized record is 4120 bytes.

When the host page size is at least 4120 bytes, the documented record does not cross a page boundary. The scanner may report that the system is not exposed by the documented page geometry.

This conclusion applies only to the documented record and assessed implementation behavior. It is not a general statement that all FUSE memory-safety issues are impossible on larger-page systems.

5. Installed source inspection

When installed source is available, the scanner searches:

fs/fuse/readdir.c

It looks for the affected function and a guard equivalent to rejecting reclen > PAGE_SIZE.

Direct source evidence has higher confidence than version comparison.

The inspected source must correspond to the running kernel for the result to be authoritative. Distribution source trees under /usr/src may represent a different installed kernel.

6. Kernel package evidence

The scanner attempts to map the running kernel image to its owning package using the detected distribution's package database.

Possible mechanisms include:

dpkg-query -S
rpm -qf
pacman -Qo
apk info -W

When a package is identified, local changelog metadata may be inspected for the CVE ID or patch title.

No changelog match is not proof of vulnerability. Vendors do not always include individual CVE references in locally installed changelogs.

7. Upstream version comparison

The parsed kernel version is compared with the scanner's fixed baseline table.

Version comparison produces a heuristic result because:

• vendor kernels may contain backports;
• kernel package release revisions are distribution-specific;
• cloud, real-time, hardened, and hardware-enablement kernels may have separate patch timelines;
• a version string can represent a vendor-maintained branch rather than an unmodified upstream release.

8. Package update metadata

Where supported, the scanner runs read-only queries against existing local metadata.

It does not refresh repositories.

Examples:

apt list --upgradable
pacman -Qu
dnf --cacheonly --quiet check-upgrade
zypper --no-refresh list-patches --all --cve=CVE-2026-31694
apk version -l <

A result showing no available update is only as current as the cached repository metadata.

9. Reboot state

On a normal host or virtual machine, the scanner compares the running kernel with detected installed kernels and checks the reboot marker used by Debian-family systems.

Inside a container or WSL guest, this check is marked as host-controlled instead of comparing guest files with the host kernel.

10. Verdict generation

Evidence precedence is approximately:

1. direct source or package patch evidence;
2. FUSE disabled;
3. documented page geometry not exposed;
4. upstream fixed or unaffected baseline;
5. upstream potentially affected version;
6. inconclusive evidence.

Verdicts

PATCHED

Direct local evidence indicates that the correction exists.

Examples:

• matching source guard in the relevant kernel source;
• local kernel package metadata references the CVE or patch.

Confidence is normally high, but source-to-running-kernel alignment should still be verified.

NOT_EXPOSED

The detected running-kernel configuration has FUSE disabled.

This is an exposure result, not evidence that the kernel source itself contains the correction.

NOT_EXPOSED_BY_DOCUMENTED_PAGE_GEOMETRY

The memory page size is large enough to contain the documented 4120-byte record without crossing a page boundary.

This verdict is limited to the documented vulnerability geometry.

UPSTREAM_BASELINE_SAFE

The parsed running version meets a known fixed upstream baseline or predates the affected implementation.

Vendor package verification remains preferable.

POTENTIALLY_VULNERABLE

The parsed kernel is within an affected upstream range and no direct local patch evidence was found.

This result requires checking the operating-system vendor advisory before declaring the installed kernel vulnerable.

INCONCLUSIVE

The scanner could not obtain enough evidence.

Common causes:

• unavailable kernel configuration;
• unrecognized version string;
• inaccessible source or package metadata;
• unsupported distribution;
• execution inside a container;
• host-managed kernel;
• vendor backport status unavailable locally.

NOT_APPLICABLE

The current operating system is not Linux.

Exit Codes

Example:

python3 cve_2026_31694_scanner.py
status=$?

case "$status" in
  0)
    echo "No actionable exposure detected by the scanner"
    ;;
  1)
    echo "Potential exposure detected"
    ;;
  2)
    echo "Assessment inconclusive"
    ;;
  3)
    echo "Scanner execution failed"
    ;;
esac

When --no-exit-status is specified, the scanner returns 0 after producing the report.

Detection Sources

The scanner uses the following local sources where available:

Distribution Support

Distribution-family detection

Local update-query support

The absence of a locally visible update does not mean a fixed package is unavailable. Repository metadata may be stale or the distribution may not yet have published a package.

Mitigation Generation

Mitigation guidance is selected according to:

• distribution family;
• package manager;
• container or WSL status;
• FUSE configuration;
• /dev/fuse availability;
• active FUSE mounts;
• reboot state;
• final verdict.

The scanner prints commands but never executes them.

Debian and Ubuntu family

Typical generated sequence:

sudo apt update
sudo apt full-upgrade
sudo reboot

Review the proposed package transaction before approving it.

After reboot:

uname -r
python3 cve_2026_31694_scanner.py

Arch and Manjaro family

Typical generated sequence:

sudo pacman -Syu
sudo reboot

Arch-family systems require a complete system upgrade. Do not refresh package databases with pacman -Sy and then install selected packages without completing the upgrade.

Fedora and RHEL family

Typical generated sequence:

sudo dnf upgrade --refresh
sudo systemctl reboot

Systems using yum may receive the corresponding yum command.

SUSE family

Typical generated sequence:

sudo zypper refresh
sudo zypper patch --cve=CVE-2026-31694
sudo zypper patch --category security
sudo systemctl reboot

The CVE-specific patch may not be available as a separate transaction on every SUSE product or repository state.

Alpine Linux

Typical generated sequence:

doas apk update
doas apk upgrade
doas reboot

The privilege prefix depends on whether the scanner finds sudo, doas, or an already-root session.

Gentoo Linux

Typical generated sequence:

sudo emaint sync -a
sudo emerge --ask --update --deep --newuse @world

Kernel installation and activation depend on the host's configured Gentoo kernel workflow.

Void Linux

Typical generated sequence:

sudo xbps-install -Suv
sudo reboot

NixOS

Typical generated sequence:

sudo nixos-rebuild switch --upgrade
sudo systemctl reboot

Temporary controls

When patching cannot be completed immediately, the scanner may suggest temporary controls.

Possible recommendations include:

• unload the FUSE module when no FUSE mounts are active;
• blacklist a loadable FUSE module;
• temporarily restrict /dev/fuse;
• remove /dev/fuse from untrusted containers;
• remove CAP_SYS_ADMIN;
• avoid --privileged containers.

These controls can disrupt legitimate workloads, including:

• SSHFS;
• AppImage;
• rclone mounts;
• desktop portals;
• rootless container tools;
• user-space filesystems.

Temporary restrictions must not replace installation of a vendor-fixed kernel.

Container and WSL Behavior

Containers

Containers normally share the host kernel.

A scanner executed inside a container may detect:

• the host kernel release;
• container filesystem package metadata;
• no matching host kernel package;
• no /dev/fuse, even when the host has FUSE enabled.

For this reason, the scanner marks host-dependent evidence as non-authoritative and directs mitigation to the container host.

Run the scanner directly on the host for an authoritative package and reboot assessment.

Container hardening guidance includes removing:

--device /dev/fuse
--cap-add SYS_ADMIN
--privileged

Equivalent Compose configuration should also be reviewed:

devices:
  - /dev/fuse:/dev/fuse

cap_add:
  - SYS_ADMIN

privileged: true

WSL

The WSL kernel is managed by Windows rather than the Linux guest distribution's kernel package.

Typical generated guidance:

wsl --update
wsl --shutdown

Run these commands from Windows PowerShell, restart the distribution, and rerun the scanner.

Updating only guest packages with apt, dnf, or another Linux package manager does not replace the WSL kernel.

Virtual machines

A virtual machine normally owns its guest kernel. Distribution-specific package and reboot checks remain applicable inside the guest.

The hypervisor host should be assessed separately.

Report Formats

Text

Text output is intended for direct terminal use.

python3 cve_2026_31694_scanner.py --format text

The report contains:

• host summary;
• evidence checks;
• package updates when visible;
• verdict and confidence;
• mitigation guide;
• verification commands;
• cautions;
• notes;
• exit code.

JSON

JSON output contains the complete dataclass-based report.

python3 cve_2026_31694_scanner.py \
  --format json \
  --output report.json

Example field selection:

python3 cve_2026_31694_scanner.py --format json --no-exit-status |
  python3 -c '
import json
import sys

report = json.load(sys.stdin)
print(report["hostname"])
print(report["verdict"])
print(report["confidence"])
print(report["kernel_release"])
'

Markdown

Markdown output is suitable for technical records, tickets, and assessment reports.

python3 cve_2026_31694_scanner.py \
  --format markdown \
  --output report.md

Mitigation-only report

python3 cve_2026_31694_scanner.py \
  --mitigation-only \
  --format markdown

With JSON format, mitigation-only mode returns the mitigation object rather than the complete host report.

Automation and Integration

Shell gate

#!/usr/bin/env bash

set -u

report="cve-2026-31694-$(hostname)-$(date +%Y%m%d-%H%M%S).json"

python3 cve_2026_31694_scanner.py \
  --format json \
  --output "$report"

status=$?

case "$status" in
  0)
    echo "Assessment completed without a potential-vulnerability verdict"
    ;;
  1)
    echo "Potential CVE-2026-31694 exposure detected: $report" >&2
    ;;
  2)
    echo "Assessment inconclusive: $report" >&2
    ;;
  *)
    echo "Scanner failure: $report" >&2
    ;;
esac

exit "$status"

Report collection without failing a job

python3 cve_2026_31694_scanner.py \
  --format json \
  --output /var/tmp/cve-2026-31694.json \
  --no-exit-status

Cron example

30 3 * * * /usr/bin/python3 /opt/security/cve_2026_31694_scanner.py --format json --output /var/log/cve-2026-31694.json --no-exit-status

This overwrites the same report file. Use a wrapper script when historical reports are required.

Systemd service example

[Unit]
Description=Passive CVE-2026-31694 assessment
After=local-fs.target

[Service]
Type=oneshot
ExecStart=/usr/bin/python3 /opt/security/cve_2026_31694_scanner.py --format json --output /var/log/cve-2026-31694.json --no-exit-status
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/log

The scanner needs read access to kernel and package metadata. Additional sandbox restrictions may hide evidence and produce an inconclusive report.

Fleet usage

For fleet assessment:

1. place the script on each Linux host;
2. execute it locally;
3. collect JSON output;
4. group results by:
   • distribution;
   • kernel release;
   • verdict;
   • confidence;
   • environment type;
5. verify potentially affected hosts against vendor advisories;
6. patch and reboot;
7. rescan.

Do not treat a scan from a container image build as a host-kernel assessment.

Operational Guidance

Recommended response to POTENTIALLY_VULNERABLE

1. Identify the exact running kernel:

   root@kitploit:~

   uname -r
   

2. Identify the installed distribution and release:

   root@kitploit:~

   cat /etc/os-release
   

3. Review the distribution vendor's CVE status for the exact kernel package and flavor.

4. Refresh package metadata.

5. install the vendor-supported fixed kernel package.

6. Reboot the host.

7. Confirm the running kernel changed:

   root@kitploit:~

   uname -r
   

8. Rerun the scanner.

Recommended response to INCONCLUSIVE

Collect missing evidence:

uname -a
getconf PAGE_SIZE
cat /etc/os-release
grep CONFIG_FUSE_FS /boot/config-"$(uname -r)" 2>/dev/null
cat /proc/filesystems
ls -l /dev/fuse 2>/dev/null
findmnt -t fuse,fuseblk,fusectl

Then verify the exact kernel package against the vendor advisory.

Reboot verification

Installing a fixed kernel package does not change the currently executing kernel.

Verify both installed and running kernels, then reboot as required.

Examples:

uname -r
ls -1 /lib/modules

Debian-family systems may also provide:

test -e /var/run/reboot-required && cat /var/run/reboot-required

FUSE dependency review

Before temporarily unloading or blocking FUSE:

findmnt -t fuse,fuseblk,fusectl
lsmod | grep '^fuse'
ps aux | grep -E '[f]usermount|[s]shfs|[r]clone'

Do not unload the module while active FUSE filesystems are mounted.

Limitations

No exploit confirmation

The scanner intentionally does not trigger the vulnerable code path.

A POTENTIALLY_VULNERABLE verdict means the available passive evidence is consistent with exposure. It is not proof that exploitation will succeed.

Vendor backports

Distribution kernels frequently backport security corrections.

An older-looking upstream version may be patched.

The vendor advisory and exact package release are authoritative for distribution-managed kernels.

Source-tree mismatch

A source tree found under /usr/src may not match the running kernel.

Source patch evidence should be validated against:

uname -r

and the source package or build directory used for that exact kernel.

Stale package metadata

The scanner does not refresh repositories.

Package update checks depend on existing local cache state.

Use the generated distribution-specific refresh and upgrade commands for an up-to-date package decision.

Containers

A container sees the host kernel but normally has different package metadata.

Run the scanner on the host.

WSL

Linux guest package state does not determine WSL kernel patch status.

Update WSL from Windows.

Custom kernels

Custom, embedded, appliance, vendor, and self-built kernels may not have package metadata or recognizable version strings.

Inspect the actual source commit or vendor release notes.

Live patching

The scanner does not determine whether a live-patch framework has applied this specific correction to the running kernel.

Use the live-patch vendor's status tools and advisory data.

Secure boot and bootloader state

The scanner does not verify:

• which kernel the bootloader will select next;
• whether Secure Boot accepts the installed image;
• whether a new initramfs was generated correctly;
• whether the machine successfully rebooted into the expected kernel.

Distributed filesystems and namespaces

The scanner assesses the current process namespace.

Mounts or device access hidden by namespaces may not appear in the report.

Troubleshooting

Kernel configuration could not be determined

Check whether one of these files exists:

ls -l /proc/config.gz
ls -l /boot/config-"$(uname -r)"
ls -l /lib/modules/"$(uname -r)"/build/.config

Some distributions do not expose the running configuration through /proc/config.gz.

Running kernel package could not be identified

Possible causes:

• running inside a container;
• kernel image is not present in the current filesystem;
• custom kernel;
• package database unavailable;
• kernel provided by the platform;
• insufficient permissions.

Check:

uname -r
ls -l /boot
ls -l /lib/modules/"$(uname -r)"

Package update query reports no update

Refresh package metadata using the generated mitigation guide, then rerun the scanner.

The passive scanner does not refresh repositories automatically.

POTENTIALLY_VULNERABLE after installing updates

Confirm that the new kernel is running:

uname -r

Compare it with installed kernel directories:

ls -1 /lib/modules

A reboot may still be required.

Also check the vendor advisory because a fixed backport may not match the upstream version baseline.

FUSE is built into the kernel

When the report shows:

CONFIG_FUSE_FS=y

modprobe -r fuse and module blacklisting cannot disable FUSE.

Use a patched kernel or a kernel built without FUSE support.

Scanner output is incomplete under systemd sandboxing

The scanner may need read access to:

/proc
/boot
/lib/modules
/usr/lib/modules
/usr/src
package database directories
package cache directories

Adjust service hardening so these paths remain readable.

File Layout

Recommended project layout:

cve-2026-31694-scanner/
├── README.md
└── cve_2026_31694_scanner.py

Recommended installed layout:

/opt/security/cve-2026-31694/
├── README.md
└── cve_2026_31694_scanner.py

Example:

sudo install -d -m 0755 /opt/security/cve-2026-31694

sudo install -m 0755 \
  cve_2026_31694_scanner.py \
  /opt/security/cve-2026-31694/

sudo install -m 0644 \
  README.md \
  /opt/security/cve-2026-31694/

References

• CVE record: https://www.cve.org/CVERecord?id=CVE-2026-31694
• NVD record: https://nvd.nist.gov/vuln/detail/CVE-2026-31694
• Linux stable patch reference: https://git.kernel.org/stable/c/51a8de6c50bf947c8f534cd73da4c8f0a13e7bed
• Ubuntu status: https://ubuntu.com/security/CVE-2026-31694
• Debian security tracker: https://security-tracker.debian.org/tracker/CVE-2026-31694
• Red Hat CVE database: https://access.redhat.com/security/cve/CVE-2026-31694
• SUSE CVE database: https://www.suse.com/security/cve/CVE-2026-31694.html

Author

Aung Myat Thu [w01f]