fs/statmount IdMap OOB Write

Vulnerability analysis

The root cause is in statmount_mnt_idmap() in fs/mnt_idmapping.c. After calling seq_printf() to write a UID/GID mapping entry, the code unconditionally increments seq->count to account for a NUL separator. If seq_printf() overflowed the buffer, seq_set_overflow() sets seq->count to seq->size (the sentinel overflow value). The subsequent seq->count++ advances it to seq->size + 1, which is beyond the sentinel, causing seq_has_overflowed() to return false. The corrupted count propagates back to statmount_string(), which then executes seq->buf[seq->count++] = '\0', writing a NUL byte one position past the end of the allocated seq buffer — a 1-byte heap out-of-bounds write. The fix adds an overflow check immediately after seq_printf() and returns -EAGAIN before the manual increment, so the overflow is properly detected and handled. The attack surface is the statmount(2) syscall, which is accessible to unprivileged local users querying idmapped mounts. No special privileges beyond a local account are required to trigger the overflow, though reliable exploitation requires heap layout manipulation (AC:High).