Executive brief
A vulnerability in the Linux kernel's HFS+ filesystem driver could allow a system crash or information leakage when a specially crafted or corrupted disk is mounted. The issue occurs because the system does not properly verify the size of data records read from the disk, leading to the use of uninitialized memory. This could be exploited by an attacker with physical access to the machine or the ability to mount malicious disk images.
Technical details
A vulnerability exists in the hfsplus driver where hfs_brec_read() fails to validate that the on-disk record size matches the expected size for the specific record type (folder, file, or thread). When mounting a corrupted filesystem, the function may perform a partial read, leaving significant portions of the internal buffer uninitialized. This uninitialized data is subsequently used in hfsplus_strcasecmp() and as array indices in case_fold(), leading to undefined behavior or kernel memory disclosure. The fix introduces hfsplus_brec_read_cat() to enforce size validation based on record type and ensures the temporary entry structure is zero-initialized.
Affected products
- Linux Linux Kernel v2.6.12-rc2 to v6.13
Timeline
- 2026-05-08: other: Patch authored
- 2026-05-28: disclosed: CVE published
References
- https://git.kernel.org/stable/c/61a790974ff7e533acbceca06c7d02f22bf96d4d
- https://git.kernel.org/stable/c/93e8d613f1a01b6637f387cc93f184cf7fb881d6
- https://git.kernel.org/stable/c/a420904450962a562ad053a41a53a27755021b48
- https://git.kernel.org/stable/c/b6b592275aeff184aa82fcf6abccd833fb71b393
- https://git.kernel.org/stable/c/c91bbd6193c70a02c50c22e0fb1f60c3c5bd053a