CVE-2026-64267 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
fuse: avoid 32-bit prune notification count wrap
FUSE_NOTIFY_PRUNE validates the nodeid payload length with:
size - sizeof(outarg) != outarg.count * sizeof(u64)
On 32-bit kernels, size_t is also 32 bits, so the daemon-controlled count multiplication can wrap. A prune notification with count 0x20000000 and no nodeid payload passes the check, enters the copy loop, and asks the device copy path to read nodeids that are not present in the userspace write buffer. In QEMU this reaches the fuse_copy_fill() BUG_ON(!err) path.
Validate the payload length with array_size() instead. That accepts exactly the same valid messages, but avoids wrapping arithmetic before the copy loop consumes the count.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability identified in the Linux kernel's FUSE (Filesystem in Userspace) subsystem represents a critical integer overflow issue that can lead to arbitrary code execution and system instability. This flaw specifically affects 32-bit kernel architectures where the size_t data type is limited to 32 bits, creating a scenario where arithmetic operations can produce unexpected results due to wraparound behavior. The vulnerability manifests in the FUSE_NOTIFY_PRUNE notification handling mechanism, which processes prune notifications sent from userspace daemons to inform the kernel about nodes that should be removed from the filesystem cache. When a malicious daemon sends a prune notification with a carefully crafted count value of 0x20000000, the validation logic fails to properly account for potential arithmetic overflow, allowing the malformed data to pass initial checks and proceed to the copy loop where the actual damage occurs.
The technical implementation of this vulnerability stems from the improper validation of payload lengths in the FUSE subsystem's notification handling code. The original validation check uses the expression size - sizeof(outarg) != outarg.count * sizeof(u64) which becomes problematic on 32-bit systems due to integer overflow during the multiplication operation. When outarg.count equals 0x20000000, the multiplication by sizeof(u64) (which is 8 bytes) results in an arithmetic wraparound that produces a value smaller than the actual buffer size, causing the validation to incorrectly pass. This allows the kernel to proceed with processing a notification that references nodeids which do not actually exist within the userspace write buffer, leading to memory corruption and potentially exploitable conditions.
The operational impact of this vulnerability extends beyond simple system instability to encompass potential privilege escalation and denial of service attacks. When the malicious prune notification reaches the fuse_copy_fill() function in QEMU, it triggers a BUG_ON(!err) assertion failure that causes kernel panics and system crashes. This behavior demonstrates how seemingly benign filesystem operations can be leveraged to create critical system vulnerabilities, particularly in virtualized environments where QEMU serves as the primary hypervisor interface for FUSE operations. The vulnerability affects systems running 32-bit kernels with FUSE support, making it particularly concerning for older hardware and embedded systems that may not have received timely security updates.
The recommended mitigation strategy involves replacing the vulnerable validation logic with array_size() function calls which properly handle potential arithmetic overflows by performing bounds checking before any copy operations occur. This approach maintains compatibility with valid messages while preventing the wraparound conditions that enable exploitation, aligning with secure coding practices outlined in CWE-190, which addresses integer overflow and underflow vulnerabilities. The fix ensures that all valid prune notifications continue to function correctly while eliminating the possibility of malicious actors crafting payloads that exploit arithmetic wraparounds. This remediation approach follows ATT&CK technique T1068 by preventing privilege escalation through kernel-level vulnerabilities, and demonstrates proper defensive programming principles that should be applied across similar subsystems within the Linux kernel to prevent analogous issues in other notification handling mechanisms.
The vulnerability highlights fundamental security considerations in kernel-space memory management and the critical importance of validating user-supplied data before processing. The issue represents a classic example of how seemingly innocuous arithmetic operations can create exploitable conditions when not properly bounded, particularly in systems where architectural limitations such as 32-bit addressing constraints interact with mathematical operations. Security researchers should consider similar patterns in other kernel subsystems that perform buffer size calculations and multiplication operations on user-provided values, as the same principles apply to prevent integer overflow vulnerabilities across different components of the Linux kernel ecosystem.