The Linux kernel's FUSE subsystem had a vulnerability where the 32-bit prune notification count could wrap due to multiplication overflow on 32-bit kernels. Specifically, the FUSE_NOTIFY_PRUNE operation validated the nodeid payload length by comparing size minus the size of an output argument to the count multiplied by the size of a 64-bit integer. On 32-bit systems, the multiplication could overflow, allowing a prune notification with a large count and no nodeid payload to pass validation incorrectly. This leads to a copy loop attempting to read non-existent node IDs, triggering a kernel bug path (fuse_copy_fill() BUG_ON(!err)). The fix involved using array_size() for validation, which prevents wrapping arithmetic before the copy loop.

The vulnerability can cause a kernel bug condition resulting in a denial of service (system crash) on affected 32-bit Linux kernels using FUSE. There is no indication of confidentiality or integrity impact. The CVSS score of 5.5 reflects a medium severity denial of service impact with local attack vector and low privileges required.

A fix has been implemented in the Linux kernel to address this vulnerability by changing the validation method to avoid 32-bit integer wrapping. Users should apply the official kernel updates that include this fix. Since this is a kernel-level issue, updating the kernel to a patched version is the recommended remediation. Patch status is not explicitly confirmed here; check the vendor or distribution advisory for the exact fixed versions and update instructions.