CVE-2026-64267 describes a vulnerability in the Linux kernel's FUSE implementation where the 32-bit prune notification count could wrap due to 32-bit size_t arithmetic on 32-bit kernels. The FUSE_NOTIFY_PRUNE message validation originally multiplied a daemon-controlled count by sizeof(u64) without preventing integer wrap, allowing crafted messages with large counts to bypass checks and cause out-of-bounds reads in the userspace write buffer. This leads to a kernel BUG_ON condition in fuse_copy_fill(). The fix involved replacing the vulnerable multiplication check with array_size(), which prevents wrapping arithmetic and ensures proper payload length validation.

On affected 32-bit Linux kernels, this vulnerability could allow a malicious FUSE daemon to send specially crafted prune notifications that cause the kernel to read beyond the intended buffer boundaries. This triggers a kernel BUG_ON condition, potentially leading to denial of service via kernel crash. There is no indication of code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to address this vulnerability by changing the validation method to prevent 32-bit integer wrap in prune notification count checks. Users should apply the official kernel updates that include this fix. Since no specific patch links or vendor advisories are provided, check the Linux kernel mailing lists or vendor advisories for the official patch and update guidance. No additional mitigations are indicated.