PT-2026-61391 · Linux · Linux

CVE-2026-64074

·

Publicado

2026-07-19

·

Atualizado

2026-07-19

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
In the Linux kernel, the following vulnerability has been resolved:
fs/statmount: fix slab out-of-bounds write in statmount mnt idmap
statmount mnt idmap() writes one mapping with seq printf() and then manually advances seq->count to include the NUL separator.
If seq printf() overflows, seq set overflow() sets seq->count to seq->size. The manual seq->count++ changes this to seq->size + 1. seq has overflowed() then no longer detects the overflow. The corrupted count returns to statmount string(), which later executes:
seq->buf[seq->count++] = '0';
This causes a 1-byte NULL out-of-bounds write on the dynamically allocated seq buffer.
Fix this by checking for overflow immediately after seq printf().

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64074

Produtos afetados

Linux