CVE-2026-64074: fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap
In the Linux kernel, the following vulnerability has been resolved:
fs/statmount: fix slab out-of-bounds write in statmountmntidmap
statmountmntidmap() writes one mapping with seqprintf() and then manually advances seq->count to include the NUL separator.
If seqprintf() overflows, seqsetoverflow() sets seq->count to seq->size. The manual seq->count++ changes this to seq->size + 1. seqhasoverflowed() then no longer detects the overflow. The corrupted count returns to statmountstring(), which later executes:
seq->buf[seq->count++] = '\0';
This causes a 1-byte NULL out-of-bounds write on the dynamically allocated seq buffer.
Fix this by checking for overflow immediately after seqprintf().
Affected Software
Remediation
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What is the potential impact of successful exploitation?
The issue can cause a one-byte NULL out-of-bounds write on a dynamically allocated seq buffer. The CVSS assessment rates confidentiality, integrity, and availability impact as high.
Is a fix available?
Yes. A patch is available, with fixes referenced in the Linux stable kernel repository.