CVE-2026-64074

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap<br /> <br /> statmount_mnt_idmap() writes one mapping with seq_printf() and then<br /> manually advances seq-&gt;count to include the NUL separator.<br /> <br /> If seq_printf() overflows, seq_set_overflow() sets seq-&gt;count to<br /> seq-&gt;size. The manual seq-&gt;count++ changes this to seq-&gt;size + 1.<br /> seq_has_overflowed() then no longer detects the overflow. The corrupted<br /> count returns to statmount_string(), which later executes:<br /> <br /> seq-&gt;buf[seq-&gt;count++] = &amp;#39;\0&amp;#39;;<br /> <br /> This causes a 1-byte NULL out-of-bounds write on the dynamically<br /> allocated seq buffer.<br /> <br /> Fix this by checking for overflow immediately after seq_printf().