CVE-2026-64074

In the Linux kernel, the following vulnerability has been resolved:

fs/statmount: fix slab out-of-bounds write in statmountmntidmap

statmountmntidmap() writes one mapping with seq_printf() and then manually advances seq->count to include the NUL separator.

If seqprintf() overflows, seqsetoverflow() sets seq->count to seq->size. The manual seq->count++ changes this to seq->size + 1. seqhasoverflowed() then no longer detects the overflow. The corrupted count returns to statmountstring(), which later executes:

seq->buf[seq->count++] = '\0';

This causes a 1-byte NULL out-of-bounds write on the dynamically allocated seq buffer.

Fix this by checking for overflow immediately after seq_printf().