{"id":"CVE-2026-64074","summary":"fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap\n\nstatmount_mnt_idmap() writes one mapping with seq_printf() and then\nmanually advances seq-\u003ecount to include the NUL separator.\n\nIf seq_printf() overflows, seq_set_overflow() sets seq-\u003ecount to\nseq-\u003esize. The manual seq-\u003ecount++ changes this to seq-\u003esize + 1.\nseq_has_overflowed() then no longer detects the overflow. The corrupted\ncount returns to statmount_string(), which later executes:\n\n    seq-\u003ebuf[seq-\u003ecount++] = '\\0';\n\nThis causes a 1-byte NULL out-of-bounds write on the dynamically\nallocated seq buffer.\n\nFix this by checking for overflow immediately after seq_printf().","modified":"2026-07-22T05:29:51.484342781Z","published":"2026-07-19T15:39:49.076Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64074.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/93614949dc86f068e3c32c32cf1ee2a2323177a7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a3bf0f28d4ba16e1f35f8c983bb04426b87e2a78"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e37ea2c6f17f273813ea4e8e94c102591d598ce1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64074.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64074"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"37c4a9590e1efcae7749682239fc22a330d2d325"},{"fixed":"e37ea2c6f17f273813ea4e8e94c102591d598ce1"},{"fixed":"93614949dc86f068e3c32c32cf1ee2a2323177a7"},{"fixed":"a3bf0f28d4ba16e1f35f8c983bb04426b87e2a78"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64074.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.15.0"},{"fixed":"6.18.34"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64074.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}