CVE-2026-64361

Analyzed Analyzed - Analysis Complete

Integer Overflow in Linux Kernel HFS/HFS+ Filesystem

Publication date: 2026-07-25

Last updated on: 2026-09-04

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length check_and_correct_requested_length() compares (off + len) against node_size using u32 arithmetic. When the caller passes a large len value (e.g. from an underflowed subtraction in hfs_brec_remove()), off + len can wrap past 2^32 and produce a small result, causing the bounds check to pass when it should fail. For example, with off=14 and len=0xFFFFFFF2 (underflowed from data_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6, which is less than a typical node_size of 512, so the check passes and the subsequent memmove reads ~4GB past the node buffer. Fix this by widening the addition to u64 before comparing against node_size. This prevents the u32 wrap while keeping the logic straightforward.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-04

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64361

EUVD

EUVD-2026-48905

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.4.297 (inc) to 5.5 (exc)
linux	linux_kernel	From 6.15.11 (inc) to 6.16 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 5.10.241 (inc) to 5.10.261 (exc)
linux	linux_kernel	From 5.15.190 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 6.1.149 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.6.103 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.12.43 (inc) to 6.12.97 (exc)
linux	linux_kernel	From 6.16.2 (inc) to 6.18.40 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

This is a buffer overflow vulnerability in the Linux kernel's HFS and HFS+ file system drivers. It occurs when calculating file offsets and lengths using 32-bit arithmetic, which can wrap around and produce incorrect results. Specifically, the function check_and_correct_requested_length() fails to detect when a requested memory operation would exceed buffer bounds due to this wrap-around.

Detection Guidance

This vulnerability is specific to the Linux kernel's HFS/HFS+ filesystem handling. Detection requires checking if your system runs a vulnerable kernel version. Use uname -a to check the kernel version and compare it against patched versions. Inspect filesystem operations on HFS/HFS+ volumes for unusual memory access patterns.

Impact Analysis

An attacker could exploit this to read or write memory outside intended buffer limits, potentially causing system crashes, data corruption, or privilege escalation. This could lead to unauthorized access to sensitive data or denial of service on affected systems running vulnerable Linux kernels.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling buffer overflow attacks that may lead to unauthorized data access or corruption. Exploiting this flaw might allow attackers to read or modify sensitive data, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Update your Linux kernel to the latest patched version immediately. Avoid mounting or using HFS/HFS+ filesystems from untrusted sources. If HFS/HFS+ support is not required, consider disabling the filesystem modules (hfs, hfsplus) via kernel configuration or blacklisting.

Hi! I’m here to help you understand CVE-2026-64361. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70