A flaw in the Linux kernel’s statmount_mnt_idmap routine writes one byte beyond the bounds of a dynamically allocated sequence buffer due to an improper overflow check. The corrupted count is later used to terminate the string, causing a 1‑byte NULL out‑of‑bounds write that can corrupt neighboring kernel memory. Such memory corruption could destabilise the kernel or allow an attacker with sufficient privileges to execute arbitrary code or crash the system.

Any Linux kernel build that contains the original fs/statmount implementation and has not incorporated the upstream patch is affected. The advisory does not tie the vulnerability to a specific distribution or kernel version, so all unpatched releases remain at risk until the code change is applied.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation attempts are currently unlikely. The flaw is not listed in the CISA KEV catalog. Based on the description, the attacker would need local access to trigger the statmount path; the likely attack vector is local, requiring the ability to read or traverse the vulnerable path to execute the vulnerable routine. Successful exploitation could lead to privilege escalation, kernel compromise, or denial of service.