Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-64360

hfs/hfsplus: zero-initialize buffer in hfs_bnode_read

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, and 3 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: zero-initialize buffer in hfs_bnode_read hfs_bnode_read() can return early without writing to the output buffer when is_bnode_offset_valid() fails or when check_and_correct_requested_ length() corrects the length to zero. Callers such as hfs_bnode_read_ u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the result unconditionally, leading to KMSAN uninit-value reports. Rather than initializing at each individual call site, zero the buffer at the start of hfs_bnode_read() before any validation checks. This ensures all callers in both hfs and hfsplus get a deterministic zero value regardless of which early-return path is taken.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 5.10.241 · fixed in 5.10.261; From 5.15.190 · fixed in 5.15.212; From 6.1.149 · fixed in 6.1.178; From 6.6.103 · fixed in 6.6.145; From 6.12.43 · fixed in 6.12.96; From 5.4.297 · fixed in 5.5; From 6.15.11 · fixed in 6.16; From 6.16.2 · fixed in 6.17

  • Linux Linux

    6.17

References 8

git.kernel.org