{"id":"CVE-2026-64074","state":"PUBLISHED","title":"fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap\n\nstatmount_mnt_idmap() writes one mapping with seq_printf() and then\nmanually advances seq->count to include the NUL separator.\n\nIf seq_printf() overflows, seq_set_overflow() sets seq->count to\nseq->size. The manual seq->count++ changes this to seq->size + 1.\nseq_has_overflowed() then no longer detects the overflow. The corrupted\ncount returns to statmount_string(), which later executes:\n\n    seq->buf[seq->count++] = '\\0';\n\nThis causes a 1-byte NULL out-of-bounds write on the dynamically\nallocated seq buffer.\n\nFix this by checking for overflow immediately after seq_printf().","publishedAt":"2026-07-19T15:39:49.076Z","updatedAt":"2026-08-05T12:38:55.440Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"37c4a9590e1efcae7749682239fc22a330d2d325","status":"affected","lessThan":"e37ea2c6f17f273813ea4e8e94c102591d598ce1","versionType":"git"},{"version":"37c4a9590e1efcae7749682239fc22a330d2d325","status":"affected","lessThan":"93614949dc86f068e3c32c32cf1ee2a2323177a7","versionType":"git"},{"version":"37c4a9590e1efcae7749682239fc22a330d2d325","status":"affected","lessThan":"a3bf0f28d4ba16e1f35f8c983bb04426b87e2a78","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/mnt_idmapping.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.15","versionType":"semver"},{"version":"6.18.34","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.11","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/mnt_idmapping.c"]}],"references":["https://git.kernel.org/stable/c/e37ea2c6f17f273813ea4e8e94c102591d598ce1","https://git.kernel.org/stable/c/93614949dc86f068e3c32c32cf1ee2a2323177a7","https://git.kernel.org/stable/c/a3bf0f28d4ba16e1f35f8c983bb04426b87e2a78"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64074.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64074","state":"PUBLISHED","datePublished":"2026-07-19T15:39:49.076Z","dateUpdated":"2026-08-05T12:38:55.440Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T07:54:57.031Z"},"containers":{"cna":{"title":"fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap\n\nstatmount_mnt_idmap() writes one mapping with seq_printf() and then\nmanually advances seq->count to include the NUL separator.\n\nIf seq_printf() overflows, seq_set_overflow() sets seq->count to\nseq->size. The manual seq->count++ changes this to seq->size + 1.\nseq_has_overflowed() then no longer detects the overflow. The corrupted\ncount returns to statmount_string(), which later executes:\n\n    seq->buf[seq->count++] = '\\0';\n\nThis causes a 1-byte NULL out-of-bounds write on the dynamically\nallocated seq buffer.\n\nFix this by checking for overflow immediately after seq_printf()."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"37c4a9590e1efcae7749682239fc22a330d2d325","status":"affected","lessThan":"e37ea2c6f17f273813ea4e8e94c102591d598ce1","versionType":"git"},{"version":"37c4a9590e1efcae7749682239fc22a330d2d325","status":"affected","lessThan":"93614949dc86f068e3c32c32cf1ee2a2323177a7","versionType":"git"},{"version":"37c4a9590e1efcae7749682239fc22a330d2d325","status":"affected","lessThan":"a3bf0f28d4ba16e1f35f8c983bb04426b87e2a78","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/mnt_idmapping.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.15","versionType":"semver"},{"version":"6.18.34","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.11","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/mnt_idmapping.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/e37ea2c6f17f273813ea4e8e94c102591d598ce1"},{"url":"https://git.kernel.org/stable/c/93614949dc86f068e3c32c32cf1ee2a2323177a7"},{"url":"https://git.kernel.org/stable/c/a3bf0f28d4ba16e1f35f8c983bb04426b87e2a78"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reachable only through the statmount(2) syscall when requesting mount UID/GID map strings; there is no network, adjacent, or physical entry path to this code.\nAC:L - An attacker fully controls statmount mask, buffer sizing, mount paths/options, and idmap extent values to reliably drive seq_printf() to overflow at the vulnerable count++ site without depending on uncontrollable timing or layout.\nPR:L - Exploitation requires creating or querying an idmapped mount via statmount, which an unprivileged local user can do in their own user/mount namespaces where CAP_SYS_ADMIN is granted by user namespaces.\nUI:N - Triggering the flaw requires only the attacker's own statmount syscall and crafted namespace/mount setup; no action by another user or victim is needed.\nS:U - Impact is kernel heap corruption and potential privilege escalation within the same kernel security domain, not a cross-boundary escape such as VM guest-to-host.\nC:H - The flaw is a slab out-of-bounds write that corrupts adjacent heap memory; per kernel CVSS guidance, exploitable memory corruption warrants High confidentiality impact even if direct read is not guaranteed.\nI:H - A one-byte out-of-bounds NULL write into adjacent kmalloc slab objects can corrupt kernel metadata and be leveraged for arbitrary memory modification or code execution.\nA:H - Heap corruption from the out-of-bounds write can cause kernel oops/panic or destabilize the system, and memory-corruption bugs are scored as High availability impact."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:38:55.440Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"6.18.34"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"7.0.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.15","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}