CVE-2026-64267
Received Received - Intake

FUSE prune notification count wrap in Linux kernel

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notification count wrap FUSE_NOTIFY_PRUNE validates the nodeid payload length with: size - sizeof(outarg) != outarg.count * sizeof(u64) On 32-bit kernels, size_t is also 32 bits, so the daemon-controlled count multiplication can wrap. A prune notification with count 0x20000000 and no nodeid payload passes the check, enters the copy loop, and asks the device copy path to read nodeids that are not present in the userspace write buffer. In QEMU this reaches the fuse_copy_fill() BUG_ON(!err) path. Validate the payload length with array_size() instead. That accepts exactly the same valid messages, but avoids wrapping arithmetic before the copy loop consumes the count.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64267
EUVD
EUVD-2026-48979

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the FUSE_NOTIFY_PRUNE function. On 32-bit systems, a controlled count value can wrap around due to 32-bit arithmetic, causing the validation check to pass incorrectly. This leads to reading nodeids that are not present in the userspace buffer, potentially triggering a BUG_ON condition in QEMU's fuse_copy_fill function.

Detection Guidance

This vulnerability is specific to the Linux kernel's FUSE subsystem and requires kernel-level inspection. Detection involves checking kernel logs for fuse-related errors or crashes, particularly those involving prune notifications. Commands like dmesg | grep -i fuse or journalctl -k | grep -i fuse may help identify suspicious activity. Ensure your kernel version is up-to-date and review FUSE-related modules for errors.

Impact Analysis

If exploited, this vulnerability could cause system instability or crashes, particularly in environments using QEMU with FUSE. It may lead to denial-of-service conditions or unexpected behavior due to memory corruption or invalid memory access.

Mitigation Strategies

Apply the latest kernel update provided by your distribution to patch the FUSE subsystem vulnerability. If immediate patching is not possible, consider disabling FUSE or restricting its use until the update is applied. Monitor kernel logs for any signs of exploitation or unusual activity related to FUSE.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64267. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart