Executive brief
A vulnerability was identified in the Linux kernel's HFS and HFS+ file system drivers, which are used to read and write disks formatted for Apple computers. Under certain conditions, the system could read uninitialized memory from the computer's stack, potentially leading to unpredictable system behavior or the exposure of small amounts of sensitive kernel data. This issue has been resolved in recent kernel updates by ensuring data buffers are properly cleared before use.
Technical details
A vulnerability in the Linux kernel's HFS and HFS+ filesystem drivers (fs/hfs/bnode.c and fs/hfsplus/bnode.c) allowed for uninitialized memory access. The function hfs_bnode_read() could return early if is_bnode_offset_valid() failed or if the requested length was corrected to zero, leaving the caller's stack-allocated buffer in an uninitialized state. Callers like hfs_bnode_read_u16() and hfs_bnode_read_u8() would then use these uninitialized values, as detected by KernelMemorySanitizer (KMSAN). The fix involves zero-initializing the buffer with memset() at the start of hfs_bnode_read() to ensure deterministic behavior.
Affected products
- Linux Linux Kernel 5.10.241 to 5.10.261; 6.1.x; 6.6.x; 6.10.x
Timeline
- 2026-05-05: other: Vulnerability fixed in source code by Tristan Madani
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0b189b2204f1a2612dc68f8d139fb5b80539e710
- https://git.kernel.org/stable/c/16ca053c2be5f4f3044dccf7fc19237dc820d394
- https://git.kernel.org/stable/c/34684a04777358b2b40ac729e54c8e45359e46b3
- https://git.kernel.org/stable/c/8f72fd25a57a457866350359ddd27a43caa62c95
- https://git.kernel.org/stable/c/d2afc7ecee476f9251dd87444f7fb6a424410922
- https://git.kernel.org/stable/c/d5b45bad75cd2730b8452aed4d3b20a2b2a12576
- https://git.kernel.org/stable/c/d67aadee19ffdf3cc8520c5a4f4d5b2916d30baf