CVE-2026-64267: Linux Kernel Privilege Escalation Flaw

CVE-2026-64267 Overview

CVE-2026-64267 is a Linux kernel vulnerability in the Filesystem in Userspace (FUSE) subsystem. The flaw resides in the FUSE_NOTIFY_PRUNE handler, which validates the nodeid payload length using arithmetic that can wrap on 32-bit kernels. A malicious FUSE daemon can craft a prune notification with a large count value that bypasses the length check, causing the kernel copy loop to read nodeids beyond the userspace write buffer. In QEMU environments, this condition reaches the fuse_copy_fill()BUG_ON(!err) path, triggering a kernel panic.

Critical Impact
A local unprivileged user controlling a FUSE daemon can trigger a kernel BUG_ON on 32-bit systems, resulting in denial of service.

Affected Products

Linux kernel FUSE subsystem on 32-bit architectures
Systems permitting unprivileged FUSE mounts
Virtualized environments including QEMU using FUSE-backed storage

Discovery Timeline

2026-07-25 - CVE-2026-64267 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64267

Vulnerability Analysis

The FUSE notification interface allows a userspace filesystem daemon to send messages to the kernel. The FUSE_NOTIFY_PRUNE handler processes batched nodeid entries and validates the payload with the expression size - sizeof(outarg) != outarg.count * sizeof(u64). On 32-bit kernels, size_t is 32 bits wide, so the multiplication outarg.count * sizeof(u64) can overflow silently. An attacker submitting a prune notification with count = 0x20000000 causes the product to wrap to zero. The check then passes even though no nodeid payload is present in the write buffer.

Root Cause

The defect is an integer overflow during input validation. The multiplication of a daemon-controlled 32-bit count by sizeof(u64) (8 bytes) wraps when count exceeds 0x1FFFFFFF. The comparison operates on wrapped arithmetic before the copy loop consumes the count, so a malformed notification satisfies the size check and proceeds into the copy path.

Attack Vector

A local user with permission to run a FUSE daemon writes a crafted notification to the FUSE device. The kernel accepts the message, enters the copy loop, and requests nodeids that do not exist in the userspace buffer. The device copy path in fuse_copy_fill() reaches BUG_ON(!err), panicking the kernel. Exploitation requires the ability to operate a FUSE daemon against a target mount but does not require elevated privileges on distributions that permit unprivileged user namespaces and FUSE mounts.

The upstream fix replaces the raw multiplication with array_size(), which detects overflow and returns SIZE_MAX, causing the length comparison to reject malformed messages before the copy loop executes. See the kernel commits referenced below for the patch content.

Detection Methods for CVE-2026-64267

Indicators of Compromise

Unexpected kernel panics with stack traces referencing fuse_copy_fill or fuse_notify_prune
BUG_ON messages in dmesg originating from FUSE notification handling
Repeated FUSE daemon crashes correlated with system instability on 32-bit hosts

Detection Strategies

Monitor kernel log output for FUSE-related BUG or Oops entries following user-initiated FUSE mounts
Audit processes writing to /dev/fuse and correlate with abnormal termination events
Track unprivileged user namespace creation events combined with FUSE mount operations on multi-tenant hosts

Monitoring Recommendations

Ingest kernel ring buffer logs into a centralized SIEM to identify FUSE-driven panics across the fleet
Alert on host uptime resets on 32-bit Linux systems running untrusted workloads
Baseline FUSE daemon behavior per host and flag deviations in notification volume or message sizes

How to Mitigate CVE-2026-64267

Immediate Actions Required

Apply the upstream Linux kernel patch series for FUSE that replaces the raw multiplication with array_size()
Restrict unprivileged FUSE mounts by disabling user_allow_other and constraining user namespace creation where feasible
Prioritize patching for 32-bit deployments and virtualization hosts that expose FUSE to untrusted tenants

Patch Information

The fix has been merged into the stable Linux kernel tree across three commits: Kernel Git Commit 54243797, Kernel Git Commit 6e2d84fd, and Kernel Git Commit c78c4b24. Distribution kernels should incorporate these commits in their next stable release cycle. Rebuild and reboot affected hosts after applying updated packages.

Workarounds

Migrate 32-bit deployments to 64-bit kernels where size_t is 64 bits and the wrap condition is not reachable with practical inputs
Disable unprivileged FUSE mounts by setting kernel.unprivileged_userns_clone = 0 on systems that do not require user namespaces
Restrict access to /dev/fuse using mandatory access control policies such as SELinux or AppArmor

bash

# Disable unprivileged user namespaces to limit FUSE mount surface
sysctl -w kernel.unprivileged_userns_clone=0
echo "kernel.unprivileged_userns_clone = 0" >> /etc/sysctl.d/99-fuse-hardening.conf

# Restrict /dev/fuse access to the fuse group only
chgrp fuse /dev/fuse
chmod 660 /dev/fuse