CVE-2026-64267: fuse: avoid 32-bit prune notification count wrap

Q: Which systems are exposed to this issue?

The vulnerable condition is specific to 32-bit Linux kernels using FUSE. It is triggered while processing FUSE_NOTIFY_PRUNE notifications.

Q: What access does an attacker need to trigger it?

An attacker needs local, low-privileged access, as reflected by the CVSS vector. The FUSE daemon controls the notification count and can supply a count of 0x20000000 with no nodeid payload to trigger the wrapped validation.

Q: What is the impact of successful exploitation?

The malformed notification can cause the kernel copy path to consume nodeids absent from the userspace write buffer. In QEMU, this reaches a BUG_ON condition in fuse_copy_fill(), resulting in a denial of service.

Q: What should be done to remediate the issue?

Apply an available patch. The fix validates the notification payload length with array_size() instead of performing a 32-bit-wrappable multiplication.

Published Jul 25, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

fuse: avoid 32-bit prune notification count wrap

FUSENOTIFYPRUNE validates the nodeid payload length with:

size - sizeof(outarg) != outarg.count sizeof(u64)

On 32-bit kernels, sizet is also 32 bits, so the daemon-controlled count multiplication can wrap. A prune notification with count 0x20000000 and no nodeid payload passes the check, enters the copy loop, and asks the device copy path to read nodeids that are not present in the userspace write buffer. In QEMU this reaches the fusecopyfill() BUGON(!err) path.

Validate the payload length with arraysize() instead. That accepts exactly the same valid messages, but avoids wrapping arithmetic before the copy loop consumes the count.

Affected Software

3 affected components

Linux Linux kernel

Linux Linux kernel>=6.18<6.18.39

Linux Linux kernel>=6.19<7.1.4

Remediation

Event History

Jul 25, 2026

CVE Published

via MITRE·08:49 AM

Data Sourced

via MITRE·08:49 AM

Description

Data Sourced

via NVD·10:17 AM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

The vulnerable condition is specific to 32-bit Linux kernels using FUSE. It is triggered while processing FUSE_NOTIFY_PRUNE notifications.

What access does an attacker need to trigger it?

An attacker needs local, low-privileged access, as reflected by the CVSS vector. The FUSE daemon controls the notification count and can supply a count of 0x20000000 with no nodeid payload to trigger the wrapped validation.

What is the impact of successful exploitation?

The malformed notification can cause the kernel copy path to consume nodeids absent from the userspace write buffer. In QEMU, this reaches a BUG_ON condition in fuse_copy_fill(), resulting in a denial of service.

What should be done to remediate the issue?

Apply an available patch. The fix validates the notification payload length with array_size() instead of performing a 32-bit-wrappable multiplication.

CVE-2026-64267: fuse: avoid 32-bit prune notification count wrap

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What access does an attacker need to trigger it?

What is the impact of successful exploitation?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What access does an attacker need to trigger it?

What is the impact of successful exploitation?

What should be done to remediate the issue?