CVE-2026-64074 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap
statmount_mnt_idmap() writes one mapping with seq_printf() and then manually advances seq->count to include the NUL separator.
If seq_printf() overflows, seq_set_overflow() sets seq->count to seq->size. The manual seq->count++ changes this to seq->size + 1. seq_has_overflowed() then no longer detects the overflow. The corrupted count returns to statmount_string(), which later executes:
seq->buf[seq->count++] = '\0';
This causes a 1-byte NULL out-of-bounds write on the dynamically allocated seq buffer.
Fix this by checking for overflow immediately after seq_printf().
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability identified in the Linux kernel's fs/statmount subsystem represents a critical out-of-bounds write condition that arises from improper handling of sequence buffer management during filesystem statistics collection. This flaw exists within the statmount_mnt_idmap function where the kernel attempts to format and output mount identification information through the seq_printf() interface while simultaneously managing buffer boundaries manually. The issue stems from a fundamental race condition between automatic overflow detection mechanisms and manual buffer pointer manipulation that creates a window for memory corruption.
The technical implementation of this vulnerability occurs when the statmount_mnt_idmap function processes mount information using seq_printf() to write a mapping entry followed by manual advancement of the sequence counter through direct seq->count++ operations. When seq_printf() encounters buffer overflow conditions, it triggers seq_set_overflow() which properly sets seq->count to seq->size to indicate overflow state. However, the subsequent manual increment operation transforms this controlled overflow state into seq->size + 1, effectively masking the actual overflow condition from seq_has_overflowed() checks. This corrupted counter value then propagates back through the call stack, ultimately causing the statmount_string() function to execute a 1-byte NULL out-of-bounds write at seq->buf[seq->count++] position where seq->count has been artificially inflated beyond valid buffer boundaries.
This vulnerability directly maps to CWE-121, which describes heap-based buffer overflow conditions, and aligns with ATT&CK technique T1059.007 for execution through kernel-level code manipulation. The operational impact of this flaw extends beyond simple memory corruption as it creates potential pathways for privilege escalation and system instability. Attackers could exploit this condition to manipulate kernel memory structures, potentially leading to arbitrary code execution or denial-of-service conditions that affect the entire operating system's stability. The vulnerability particularly impacts systems running Linux kernels where filesystem statistics are actively queried or monitored through interfaces that utilize the affected statmount functionality.
The fix implemented addresses this issue by enforcing immediate overflow detection following seq_printf() execution rather than allowing manual buffer manipulation to interfere with the established overflow state management. This approach follows secure coding practices recommended in CERT Secure Coding Standards and aligns with defensive programming principles that prioritize early validation over deferred error handling. The solution prevents the corrupted counter manipulation from propagating through the call stack while maintaining the intended functionality of sequence buffer formatting, ensuring that all buffer operations remain within safe memory boundaries as defined by the kernel's internal buffer management protocols.