CVE-2026-64360

hfs/hfsplus: zero-initialize buffer in hfs_bnode_read

Published Jul 25, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

hfs/hfsplus: zero-initialize buffer in hfs_bnode_read

hfs_bnode_read() can return early without writing to the output buffer
when is_bnode_offset_valid() fails or when check_and_correct_requested_
length() corrects the length to zero. Callers such as hfs_bnode_read_
u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the
result unconditionally, leading to KMSAN uninit-value reports.

Rather than initializing at each individual call site, zero the buffer
at the start of hfs_bnode_read() before any validation checks. This
ensures all callers in both hfs and hfsplus get a deterministic zero
value regardless of which early-return path is taken.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`67ecc81f6492275c9c54280532f558483c99c90e`	affected	< 34684a04777358b2b40ac729e54c8e45359e46b3
`a1a60e79502279f996e55052f50cc14919020475`	affected	< 0b189b2204f1a2612dc68f8d139fb5b80539e710
`fe2891a9c43ab87d1a210d61e6438ca6936e2f62`	affected	< 8f72fd25a57a457866350359ddd27a43caa62c95
`384a66b89f9540a9a8cb0f48807697dfabaece4c`	affected	< 16ca053c2be5f4f3044dccf7fc19237dc820d394
`efc095b35b23297e419c2ab4fc1ed1a8f0781a29`	affected	< d2afc7ecee476f9251dd87444f7fb6a424410922
`a431930c9bac518bf99d6b1da526a7f37ddee8d8`	affected	< f3461b84a4865d9b5e70fbb71da72ae044a3bcd2
`a431930c9bac518bf99d6b1da526a7f37ddee8d8`	affected	< d5b45bad75cd2730b8452aed4d3b20a2b2a12576
`a431930c9bac518bf99d6b1da526a7f37ddee8d8`	affected	< d67aadee19ffdf3cc8520c5a4f4d5b2916d30baf
`e7d2dc2421e821e4045775e6dc226378328de6f6`	affected	—
`fc7f732984ec91f30be3e574e0644066d07f2b78`	affected	—
`eec522fd0d28106b14a59ab2d658605febe4a3bb`	affected	—
`5.10.241`	affected	< 5.10.261
`5.15.190`	affected	< 5.15.212
`6.1.149`	affected	< 6.1.178
`6.6.103`	affected	< 6.6.145
`6.12.43`	affected	< 6.12.96
`5.4.297`	affected	< 5.5
`6.15.11`	affected	< 6.16
`6.16.2`	affected	< 6.17

Linux

affected

Version	Status	Constraints
`6.17`	affected	—
`0`	unaffected	< 6.17
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[67ecc81f6492275c9c54280532f558483c99c90e,34684a04777358b2b40ac729e54c8e45359e46b3)`	affected	code_commit	—
`[a1a60e79502279f996e55052f50cc14919020475,0b189b2204f1a2612dc68f8d139fb5b80539e710)`	affected	code_commit	—
`[fe2891a9c43ab87d1a210d61e6438ca6936e2f62,8f72fd25a57a457866350359ddd27a43caa62c95)`	affected	code_commit	—
`[384a66b89f9540a9a8cb0f48807697dfabaece4c,16ca053c2be5f4f3044dccf7fc19237dc820d394)`	affected	code_commit	—
`[efc095b35b23297e419c2ab4fc1ed1a8f0781a29,d2afc7ecee476f9251dd87444f7fb6a424410922)`	affected	code_commit	—
`[a431930c9bac518bf99d6b1da526a7f37ddee8d8,f3461b84a4865d9b5e70fbb71da72ae044a3bcd2)`	affected	code_commit	—
`[a431930c9bac518bf99d6b1da526a7f37ddee8d8,d5b45bad75cd2730b8452aed4d3b20a2b2a12576)`	affected	code_commit	—
`[a431930c9bac518bf99d6b1da526a7f37ddee8d8,d67aadee19ffdf3cc8520c5a4f4d5b2916d30baf)`	affected	code_commit	—
`e7d2dc2421e821e4045775e6dc226378328de6f6`	affected	code_commit	—
`fc7f732984ec91f30be3e574e0644066d07f2b78`	affected	code_commit	—
`eec522fd0d28106b14a59ab2d658605febe4a3bb`	affected	code_commit	—
`[5.10.241,5.10.261)`	affected	semver	—
`[5.15.190,5.15.212)`	affected	semver	—
`[6.1.149,6.1.178)`	affected	semver	—
`[6.6.103,6.6.145)`	affected	semver	—
`[6.12.43,6.12.96)`	affected	semver	—
`[5.4.297,5.5)`	affected	semver	—
`[6.15.11,6.16)`	affected	semver	—
`[6.16.2,6.17)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.17`	affected	semver	—
`[0,6.17)`	unaffected	semver	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Ubuntu USN	USN-8726-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8727-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8760-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8726-3	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8800-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8760-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8876-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.123% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0b189b2204f1a2612dc68f8d139fb5b80539e710
https://git.kernel.org/stable/c/16ca053c2be5f4f3044dccf7fc19237dc820d394
https://git.kernel.org/stable/c/34684a04777358b2b40ac729e54c8e45359e46b3
https://git.kernel.org/stable/c/8f72fd25a57a457866350359ddd27a43caa62c95
https://git.kernel.org/stable/c/d2afc7ecee476f9251dd87444f7fb6a424410922
https://git.kernel.org/stable/c/d5b45bad75cd2730b8452aed4d3b20a2b2a12576
https://git.kernel.org/stable/c/d67aadee19ffdf3cc8520c5a4f4d5b2916d30baf
https://git.kernel.org/stable/c/f3461b84a4865d9b5e70fbb71da72ae044a3bcd2
https://lore.kernel.org/linux-cve-announce/2026072520-CVE-2026-64360-402f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64360
https://www.cve.org/CVERecord?id=CVE-2026-64360

History

Aug 3, 2026 7:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-457

Jul 30, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-908
References		https://lore.kernel.org/linux-cve-announce/2026072520-CVE-2026-64360-402f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64360 https://www.cve.org/CVERecord?id=CVE-2026-64360
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Jul 30, 2026 4:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-457

Jul 25, 2026 9:30 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: zero-initialize buffer in hfs_bnode_read hfs_bnode_read() can return early without writing to the output buffer when is_bnode_offset_valid() fails or when check_and_correct_requested_ length() corrects the length to zero. Callers such as hfs_bnode_read_ u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the result unconditionally, leading to KMSAN uninit-value reports. Rather than initializing at each individual call site, zero the buffer at the start of hfs_bnode_read() before any validation checks. This ensures all callers in both hfs and hfsplus get a deterministic zero value regardless of which early-return path is taken.
Title		hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0b189b2204f1a2612dc68f8d139fb5b80539e710 https://git.kernel.org/stable/c/16ca053c2be5f4f3044dccf7fc19237dc820d394 https://git.kernel.org/stable/c/34684a04777358b2b40ac729e54c8e45359e46b3 https://git.kernel.org/stable/c/8f72fd25a57a457866350359ddd27a43caa62c95 https://git.kernel.org/stable/c/d2afc7ecee476f9251dd87444f7fb6a424410922 https://git.kernel.org/stable/c/d5b45bad75cd2730b8452aed4d3b20a2b2a12576 https://git.kernel.org/stable/c/d67aadee19ffdf3cc8520c5a4f4d5b2916d30baf https://git.kernel.org/stable/c/f3461b84a4865d9b5e70fbb71da72ae044a3bcd2