CVE-2026-64360

Analyzed Analyzed - Analysis Complete

Buffer Zeroing in Linux Kernel HFS Filesystem

Publication date: 2026-07-25

Last updated on: 2026-09-04

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: zero-initialize buffer in hfs_bnode_read hfs_bnode_read() can return early without writing to the output buffer when is_bnode_offset_valid() fails or when check_and_correct_requested_ length() corrects the length to zero. Callers such as hfs_bnode_read_ u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the result unconditionally, leading to KMSAN uninit-value reports. Rather than initializing at each individual call site, zero the buffer at the start of hfs_bnode_read() before any validation checks. This ensures all callers in both hfs and hfsplus get a deterministic zero value regardless of which early-return path is taken.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-04

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64360

EUVD

EUVD-2026-48904

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.4.297 (inc) to 5.5 (exc)
linux	linux_kernel	From 6.15.11 (inc) to 6.16 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 5.10.241 (inc) to 5.10.261 (exc)
linux	linux_kernel	From 5.15.190 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 6.1.149 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.12.43 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.16.2 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.6.103 (inc) to 6.6.145 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the hfs/hfsplus file system drivers. The function hfs_bnode_read() may return early without initializing its output buffer if certain checks fail. Callers of this function use stack-allocated buffers and rely on the returned data, which can lead to uninitialized memory being read, triggering KMSAN uninit-value reports.

Detection Guidance

This vulnerability is specific to the Linux kernel's HFS/HFS+ filesystem handling. Detection requires checking kernel versions and filesystem usage. Use 'uname -a' to check kernel version and 'mount | grep hfs' to see if HFS/HFS+ filesystems are mounted. Look for KMSAN uninit-value reports in kernel logs.

No direct commands detect this issue, but monitoring kernel logs for KMSAN warnings or checking for HFS/HFS+ filesystem usage can indicate exposure.

Impact Analysis

This vulnerability could allow attackers to read uninitialized memory from the kernel, potentially exposing sensitive information. It affects systems using HFS or HFS+ file systems, which are commonly used in macOS and some Linux distributions.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a memory initialization issue in the Linux kernel's HFS/HFS+ file system driver that could lead to uninitialized memory exposure, but no evidence suggests it impacts data protection or privacy requirements under these regulations.

Mitigation Strategies

Apply the latest kernel patches from your distribution. Disable or unmount HFS/HFS+ filesystems if not needed. Monitor kernel logs for KMSAN warnings. Update to a kernel version that includes the fix for hfs_bnode_read().

Hi! I’m here to help you understand CVE-2026-64360. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70