CVE-2026-64267: fuse: avoid 32-bit prune notification count wrap
In the Linux kernel, the following vulnerability has been resolved:
fuse: avoid 32-bit prune notification count wrap
FUSENOTIFYPRUNE validates the nodeid payload length with:
size - sizeof(outarg) != outarg.count sizeof(u64)
On 32-bit kernels, sizet is also 32 bits, so the daemon-controlled count multiplication can wrap. A prune notification with count 0x20000000 and no nodeid payload passes the check, enters the copy loop, and asks the device copy path to read nodeids that are not present in the userspace write buffer. In QEMU this reaches the fusecopyfill() BUGON(!err) path.
Validate the payload length with arraysize() instead. That accepts exactly the same valid messages, but avoids wrapping arithmetic before the copy loop consumes the count.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The vulnerable condition is specific to 32-bit Linux kernels using FUSE. It is triggered while processing FUSE_NOTIFY_PRUNE notifications.
What access does an attacker need to trigger it?
An attacker needs local, low-privileged access, as reflected by the CVSS vector. The FUSE daemon controls the notification count and can supply a count of 0x20000000 with no nodeid payload to trigger the wrapped validation.
What is the impact of successful exploitation?
The malformed notification can cause the kernel copy path to consume nodeids absent from the userspace write buffer. In QEMU, this reaches a BUG_ON condition in fuse_copy_fill(), resulting in a denial of service.
What should be done to remediate the issue?
Apply an available patch. The fix validates the notification payload length with array_size() instead of performing a 32-bit-wrappable multiplication.