TOCTOU

FUSE daemons control filesystem metadata returned to the kernel via vfs_getattr — including i_size. Setting i_size to an inflated value desynchronizes the kernel’s allocation (kmalloc based on reported size) from its ingestion (copy_from_user of actual bytes), creating a heap under-allocation. kernel_read_file() callers — finit_module(2), firmware loader, kexec_file_load(2) — are turned into kmalloc-4k SLUB slab overflow primitives. VFS trust inversion architecture, TOCTOU window analysis, and virtio-fs shared-memory attack surface covered.

udisks2 handles XFS resize via temporary /tmp/blockdev.XXXXXX mount points. Between mount creation and nosuid application, a race window allows SUID binary execution. Three-stage exploit: Polkit bypass via ~/.pam_environment local seat0 session spoofing, XFS image crafting with pwnbash SUID binary baked into mkfs.xfs Protofile metadata, D-Bus resize request flood to continuously recreate race window. Architecture-agnostic (x86/x64/ARM). Confirmed LPE on openSUSE Leap 15.6 kernel 6.4.0.