CVE-2026-64074
In the Linux kernel, the following vulnerability has been resolved: fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap statmount_mnt_idmap() writes one mapping with seq_printf() and then manually advances seq->count to include the NUL separator. If seq_printf() overflows, seq_set_overflow() sets seq->count to seq->size. The manual seq->count++ changes this to seq->size + 1. seq_has_overflowed() then no longer detects the overflow. The corrupted count returns to statmount_string(), which later executes: seq->buf[seq->count++] = '\0'; This causes a 1-byte NULL out-of-bounds write on the dynamically allocated seq buffer. Fix this by checking for overflow immediately after seq_printf().
Affected versions
Linux kernel versions
6.15
and later are affected. Fixed in
6.18.34,
7.0.11,
7.1
and their respective stable series.
References
3 totalFrequently asked questions
-
What is CVE-2026-64074?
CVE-2026-64074 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.15 onward and has been patched in 6.18.34, 7.0.11 and 7.1. CVE-2026-64074 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-64074?
Yes — CVE-2026-64074 has been patched. Fixed versions include 6.18.34, 7.0.11 and 7.1. If you are running Linux kernel 6.15 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-64074 actively exploited?
No — CVE-2026-64074 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.