CVE-2026-64267

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fuse: avoid 32-bit prune notification count wrap<br /> <br /> FUSE_NOTIFY_PRUNE validates the nodeid payload length with:<br /> <br /> size - sizeof(outarg) != outarg.count * sizeof(u64)<br /> <br /> On 32-bit kernels, size_t is also 32 bits, so the daemon-controlled<br /> count multiplication can wrap. A prune notification with count<br /> 0x20000000 and no nodeid payload passes the check, enters the copy<br /> loop, and asks the device copy path to read nodeids that are not<br /> present in the userspace write buffer. In QEMU this reaches the<br /> fuse_copy_fill() BUG_ON(!err) path.<br /> <br /> Validate the payload length with array_size() instead. That accepts<br /> exactly the same valid messages, but avoids wrapping arithmetic before<br /> the copy loop consumes the count.