Bynario AI assists Linux FUSE page-cache overflow fix

Source status: The upstream Linux commit directly names Bynario AI in an Assisted-by trailer, and NVD corroborates the kernel.org CVE, affected versions, patch references, and CVSS 7.8 high score. The same commit also has separate Reported-by credits for Qi Tang and Zijun Hu, so this entry is scoped as a direct AI-assisted accepted fix rather than a clean solo discovery attribution. Bynario's May 7, 2026 post says its LLM-driven pipeline discovered, validated, and patched two Linux kernel vulnerabilities, including CVE-2026-31694, and says a Part 2 write-up is forthcoming.

Summary

CVE-2026-31694 is a Linux kernel FUSE page-cache overflow in fuse_add_dirent_to_cache(). The vulnerable logic computed a serialized directory-entry length from a server-controlled namelen field and copied the entry into a single page-cache page. It checked whether the entry fit in the remaining space of the current page, but not whether the entry itself exceeded PAGE_SIZE.

On 4 KiB page systems, a malicious FUSE server could return a dirent with namelen=4095, producing a serialized record of 4120 bytes and overflowing the cache page by 24 bytes. The accepted fix rejects dirents that cannot fit in a single page before copying them into the readdir cache.

NVD records the issue as a kernel.org CVE with a CVSS 3.1 score of 7.8 high.

Attribution

This qualifies under Bugflation’s methodology because the upstream Linux commit names the AI system directly: Assisted-by: Bynario AI. The issue is public, has a CVE, was accepted upstream, and has a linked patch trail.

The attribution boundary matters. The commit also includes Reported-by credits for Qi Tang and Zijun Hu. Bugflation therefore treats the entry as a direct AI-assisted accepted fix, not as an uncontested solo Bynario discovery. Bynario’s own May 7 post says its LLM-driven pipeline autonomously discovered, validated, and patched two Linux kernel vulnerabilities, naming CVE-2026-31694 as the FUSE case and saying a detailed Part 2 write-up will follow.

Why it matters

The FUSE bug is a useful companion to the CAN raw socket entry. It shows the same Bynario AI-assisted patch signal in a different kernel subsystem and bug shape: page-cache memory corruption rather than an RCU teardown race.

It also illustrates why Bugflation should separate “AI-assisted accepted fix” from “sole AI discovery.” The presence of mixed reporter credits does not disqualify the entry. It just constrains what the entry should claim.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.