CVE-2026-64074

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds write occurs in the statmount mnt idmap() function. The function uses seq printf() to write a mapping and manually increments seq->count to include a NUL separator. If seq printf() overflows, seq set overflow() sets seq->count to seq->size, but the subsequent manual increment changes it to seq->size + 1. This prevents seq has overflowed() from detecting the overflow. When the corrupted count is returned to statmount string(), it results in a 1-byte NULL out-of-bounds write on the dynamically allocated seq buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.