Executive brief
A vulnerability in the Linux kernel's FUSE (Filesystem in Userspace) component could allow a malicious background process to crash the system. On 32-bit systems, the software fails to properly calculate the size of certain data requests, leading to an internal error that halts operations. This primarily impacts system stability and availability.
Technical details
An integer overflow exists in the FUSE_NOTIFY_PRUNE handler within the Linux kernel when running on 32-bit architectures. The vulnerability occurs because the multiplication of 'outarg.count' and 'sizeof(u64)' can wrap around when using 32-bit size_t types, bypassing length validation checks. An attacker-controlled FUSE daemon can provide a large count value that causes the kernel to attempt reading non-existent node IDs from the userspace buffer, eventually triggering a BUG_ON() in the fuse_copy_fill() path. This issue has been resolved by using the array_size() macro to safely perform the multiplication.
Affected products
- Linux Linux Kernel 6.18, 6.18.39, 7.1.4
Timeline
- 2026-06-10: disclosed: Vulnerability reported by Samuel Moelius of Trail of Bits
- 2026-07-25: advisory: CVE-2026-64267 published by NVD