The Linux kernel contained a vulnerability in the fs/statmount component where statmount_mnt_idmap() improperly handled the seq->count field after a seq_printf() call. If seq_printf() overflowed, seq_set_overflow() set seq->count to seq->size, but a subsequent manual increment changed it to seq->size + 1, causing seq_has_overflowed() to fail to detect the overflow. This led to a one-byte NULL out-of-bounds write on the seq buffer when statmount_string() executed seq->buf[seq->count++] = '\0'. The flaw was fixed by adding an immediate overflow check after seq_printf().

This vulnerability results in a one-byte out-of-bounds write to kernel memory, which could potentially corrupt memory and lead to undefined behavior or kernel instability. No known exploits in the wild have been reported. The impact is limited to a minor memory corruption issue within the kernel's statmount code.

A fix has been implemented in the Linux kernel source code to check for overflow immediately after seq_printf() in statmount_mnt_idmap(). Users should apply the official kernel updates or patches that include this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the current remediation guidance.