Linux Kernel FUSE CVE-2026-31694

Upgrade to patched Linux kernel versions: 6.6.136 or later for the 6.6.x LTS series, 6.12.84+ for 6.12.x, 6.18.25+ for 6.18.x, 7.0.2+ for 7.0.x, or 7.1-rc1+ for mainline kernels. Patch implementation adds explicit PAGE_SIZE validation before copying dirents to cache (commits available at https://git.kernel.org/stable/c/7de93abfaae1b2dc94da8a07a36421bd073f1d8f and series). For systems where immediate kernel updates are not feasible, apply these compensating controls with noted trade-offs: (1) Disable FUSE support entirely via 'echo "install fuse /bin/true" > /etc/modprobe.d/disable-fuse.conf' and blacklist the module-this breaks legitimate FUSE-based applications like AppImage, snapd, and user-mounted filesystems; (2) Restrict FUSE mount capabilities by removing CAP_SYS_ADMIN from untrusted users and disabling user_allow_other in /etc/fuse.conf-reduces attack surface but may impact multi-user systems; (3) In containerized environments, block FUSE device access via seccomp profiles or device cgroup denylists (devices.deny = c 10:229 rwm)-prevents exploitation in containers but breaks container-based FUSE workflows. Validation of patch application can be confirmed by checking kernel version (uname -r) against the fixed versions listed above. Distribution-specific advisories should be monitored for backported patches in vendor kernels.