FUSE_NOTIFY_PRUNE in the Linux kernel validates the length of a nodeid payload by multiplying a count value with the size of a u64. On 32‑bit kernels, size_t is 32 bits, so a large count can wrap, permitting the length check to incorrectly succeed. The kernel then copies more data than the user buffer contains, triggering a BUG_ON and causing a kernel panic. The flaw results in a complete loss of service for the affected system.

All 32‑bit Linux kernel configurations that include FUSE support are impacted. The vulnerability exists in any distribution or custom kernel that has not been patched to replace the unsafe multiplication with array_size() based validation.

The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation at present. The CVSS score of 5.5 indicates a medium severity, but the impact remains severe because a single malicious prune notification can crash the kernel. The likely attack vector is an attacker who can control or influence a FUSE mount—such as by running a malicious FUSE daemon or a privileged process within a virtual machine—to send a crafted prune notification that triggers the overflow and causes the kernel to panic.