CVE-2026-64267

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An integer wrap occurs in 32-bit kernels during the validation of the nodeid payload length for FUSE NOTIFY PRUNE. The check uses a calculation where the daemon-controlled count multiplication can wrap because size t is 32 bits. This allows a prune notification with a specific count and no nodeid payload to bypass validation and enter a copy loop, causing the device copy path to attempt reading nodeids not present in the userspace write buffer. In QEMU, this triggers the fuse copy fill() function's BUG ON(!err) path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.