Executive brief
A vulnerability was identified in the Linux kernel's HFS and HFS+ file system drivers, which are used to handle legacy Apple-formatted storage media. An error in how the system calculates data lengths could allow a malicious or malformed disk image to bypass security checks, potentially leading to a system crash or unauthorized access to kernel memory. This could impact the stability and data privacy of systems that mount these specific file system types.
Technical details
An integer overflow exists in the 'check_and_correct_requested_length' function within the HFS and HFS+ implementations. The function performs bounds checking by comparing '(off + len)' against 'node_size' using 32-bit unsigned arithmetic. If a large 'len' value is provided (e.g., due to an underflow in 'hfs_brec_remove'), the addition can wrap around, causing the check to pass incorrectly. This leads to a subsequent 'memmove' operation reading or writing significantly beyond the intended node buffer, potentially resulting in a kernel heap out-of-bounds read/write. The fix involves widening the addition to 64-bit (u64) to ensure accurate comparison.
Affected products
- Linux Linux Kernel fs/hfs/bnode.c, fs/hfsplus/hfsplus_fs.h
Timeline
- 2026-07-25: advisory: CVE-2026-64361 published by NVD
- 2026-07-24: patched: Commits pushed to various stable branches by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/607217f7ad419b53926f71e3f75001813bbc08ad
- https://git.kernel.org/stable/c/671c3fcc2ad31c1311ea6414382a2d95104ae1b9
- https://git.kernel.org/stable/c/7399c3baee7bb622a92f0b895cd4d3009a693f2b
- https://git.kernel.org/stable/c/966cb76fb2857a4242cab6ea2ea17acf818a3da7
- https://git.kernel.org/stable/c/b6a481642ea1977be2f84dc08c5affd742c177e7
- https://git.kernel.org/stable/c/c25d3c931a63e762fcaa9cb125b901c53b62403f
- https://git.kernel.org/stable/c/c8dd112173c02adf539fe2ad34a45f5e0068780d