Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-64361

hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, and 3 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length check_and_correct_requested_length() compares (off + len) against node_size using u32 arithmetic. When the caller passes a large len value (e.g. from an underflowed subtraction in hfs_brec_remove()), off + len can wrap past 2^32 and produce a small result, causing the bounds check to pass when it should fail. For example, with off=14 and len=0xFFFFFFF2 (underflowed from data_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6, which is less than a typical node_size of 512, so the check passes and the subsequent memmove reads ~4GB past the node buffer. Fix this by widening the addition to u64 before comparing against node_size. This prevents the u32 wrap while keeping the logic straightforward.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 5.10.241 · fixed in 5.10.261; From 5.15.190 · fixed in 5.15.212; From 6.1.149 · fixed in 6.1.178; From 6.6.103 · fixed in 6.6.145; From 6.12.43 · fixed in 6.12.97; From 5.4.297 · fixed in 5.5; From 6.15.11 · fixed in 6.16; From 6.16.2 · fixed in 6.17

  • Linux Linux

    6.17

References 8

git.kernel.org