Linux Kernel FUSE CVE-2026-64267

FUSE (Filesystem in Userspace) is a Linux kernel subsystem exposing a device interface through which unprivileged userspace daemons implement filesystems. The FUSE_NOTIFY_PRUNE message instructs the kernel to evict cached directory entries for specific nodeids. The vulnerable validation expression size - sizeof(outarg) != outarg.count * sizeof(u64) performs an unsigned 32-bit multiplication on 32-bit kernels: a daemon-supplied count of 0x20000000 multiplied by 8 produces 0x100000000, which truncates to 0x00000000 in a 32-bit size_t, defeating the length check entirely. The kernel then enters the nodeid copy loop with a zero-byte payload, reaches fuse_copy_fill() with no data to satisfy the read, and hits BUG_ON(!err). The fix substitutes array_size() - which uses overflow-safe saturating arithmetic - making any wrap-inducing count produce SIZE_MAX, which unambiguously fails the length check. CWE is not assigned in the source data, but the root cause class is integer overflow/wrap (CWE-190) leading to an out-of-bounds read attempt. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.