CVE-2026-64074 Overview
CVE-2026-64074 is a slab out-of-bounds write vulnerability in the Linux kernel's fs/statmount subsystem. The flaw resides in the statmount_mnt_idmap() function, which writes one mapping with seq_printf() and then manually advances seq->count to include a NUL separator. When seq_printf() overflows, seq_set_overflow() sets seq->count to seq->size, and the subsequent manual increment corrupts the count to seq->size + 1. This bypasses seq_has_overflowed() detection, causing statmount_string() to perform a 1-byte NULL out-of-bounds write on the dynamically allocated seq buffer. The vulnerability requires local access with low privileges.
Critical Impact
A local, low-privileged attacker can trigger a 1-byte heap out-of-bounds write in the kernel, potentially leading to memory corruption, privilege escalation, or denial of service.
Affected Products
- Linux kernel versions containing the statmount_mnt_idmap() implementation in fs/statmount
- Distributions shipping vulnerable kernel builds prior to the upstream stable fix
- Systems exposing the statmount() syscall to unprivileged users
Discovery Timeline
- 2026-07-19 - CVE-2026-64074 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64074
Vulnerability Analysis
The vulnerability is a heap-based out-of-bounds write [CWE-787] in the Linux kernel's mount statistics interface. The statmount_mnt_idmap() helper serializes idmap information into a seq_file buffer using seq_printf(). After the write, the function manually increments seq->count by one to reserve space for a NUL terminator separating multiple entries.
The kernel's seq_file API uses seq_set_overflow() to signal buffer exhaustion by setting seq->count = seq->size. Callers detect this condition using seq_has_overflowed(), which checks whether count == size. The manual post-increment in statmount_mnt_idmap() breaks this invariant when an overflow has already occurred, leaving seq->count at seq->size + 1.
Because the overflow indicator is corrupted, the calling code statmount_string() proceeds as if the buffer were valid and executes seq->buf[seq->count++] = '\0';. This writes a NULL byte one position past the end of the slab-allocated buffer.
Root Cause
The root cause is an assumption mismatch between the caller and the seq_file API contract. Manually mutating seq->count after a potentially failed seq_printf() invalidates the overflow-detection semantics on which downstream code relies. The upstream patch resolves this by checking seq_has_overflowed() immediately after seq_printf() and before adjusting seq->count.
Attack Vector
Exploitation requires a local user account able to invoke the statmount() syscall against mounts that carry an idmap large enough to overflow the seq buffer. A crafted idmapped mount configuration forces seq_printf() to exceed the allocated buffer size, triggering the 1-byte overwrite on an adjacent slab object. Skilled attackers can leverage slab layout grooming to convert this single-byte corruption into control over adjacent kernel objects, enabling privilege escalation from an unprivileged local process.
No public proof-of-concept exploit is currently listed in the enriched data, and the flaw is not present on the CISA Known Exploited Vulnerabilities list.
Detection Methods for CVE-2026-64074
Indicators of Compromise
- Kernel panics, KASAN slab-out-of-bounds reports, or general protection faults originating in statmount_string or statmount_mnt_idmap
- Unexpected process crashes or root escalations following calls to the statmount() syscall
- dmesg entries referencing slab corruption on kernels lacking the upstream fix
Detection Strategies
- Enable CONFIG_KASAN on test kernels to surface the out-of-bounds write immediately upon exploitation attempts
- Audit statmount() syscall usage via auditd rules or eBPF tracing to identify processes probing the interface
- Correlate kernel crash telemetry with recent process activity from non-root users to identify likely exploitation attempts
Monitoring Recommendations
- Ingest kernel logs and syscall telemetry into a centralized analytics platform for anomaly detection
- Track kernel version inventory across the fleet and alert on hosts running unpatched builds
- Monitor for unusual mount namespace or idmapped mount operations from unprivileged users
How to Mitigate CVE-2026-64074
Immediate Actions Required
- Apply the upstream stable kernel patches referenced in the kernel.org commit 93614949dc86, commit a3bf0f28d4ba, and commit e37ea2c6f17f
- Rebuild and redeploy custom kernels that include fs/statmount with the corrected overflow check
- Prioritize patching multi-tenant hosts and systems that grant shell access to untrusted users
Patch Information
The upstream fix adds an explicit seq_has_overflowed() check immediately after seq_printf() in statmount_mnt_idmap(), preventing the manual seq->count++ from executing when the buffer has already overflowed. Distribution vendors are backporting the change to supported stable kernel branches. Consult your Linux distribution's security advisories for the specific package version containing the fix.
Workarounds
- Restrict access to the statmount() syscall using seccomp-bpf profiles for untrusted workloads and containers
- Limit creation of idmapped mounts to trusted administrators via appropriate namespace and capability restrictions
- Where feasible, disable local user shell access on systems that cannot be immediately patched
# Example seccomp filter fragment blocking statmount() for untrusted processes
# Replace <NR_statmount> with the syscall number for your architecture
SCMP_ACT_ERRNO(EPERM) statmount
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
