Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-64361

hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length check_and_correct_requested_length() compares (off + len) against node_size using u32 arithmetic. When the caller passes a large len value (e.g. from an underflowed subtraction in hfs_brec_remove()), off + len can wrap past 2^32 and produce a small result, causing the bounds check to pass when it should fail. For example, with off=14 and len=0xFFFFFFF2 (underflowed from data_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6, which is less than a typical node_size of 512, so the check passes and the subsequent memmove reads ~4GB past the node buffer. Fix this by widening the addition to u64 before comparing against node_size. This prevents the u32 wrap while keeping the logic straightforward.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 67ecc81f6492275c9c54280532f558483c99c90e to < c8dd112173c02adf539fe2ad34a45f5e0068780daffected
  • a1a60e79502279f996e55052f50cc14919020475 to < fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1affected
  • fe2891a9c43ab87d1a210d61e6438ca6936e2f62 to < 671c3fcc2ad31c1311ea6414382a2d95104ae1b9affected
  • 384a66b89f9540a9a8cb0f48807697dfabaece4c to < b6a481642ea1977be2f84dc08c5affd742c177e7affected
  • efc095b35b23297e419c2ab4fc1ed1a8f0781a29 to < 7399c3baee7bb622a92f0b895cd4d3009a693f2baffected
  • a431930c9bac518bf99d6b1da526a7f37ddee8d8 to < 607217f7ad419b53926f71e3f75001813bbc08adaffected
  • a431930c9bac518bf99d6b1da526a7f37ddee8d8 to < c25d3c931a63e762fcaa9cb125b901c53b62403faffected
  • a431930c9bac518bf99d6b1da526a7f37ddee8d8 to < 966cb76fb2857a4242cab6ea2ea17acf818a3da7affected
  • e7d2dc2421e821e4045775e6dc226378328de6f6affected
  • fc7f732984ec91f30be3e574e0644066d07f2b78affected
  • eec522fd0d28106b14a59ab2d658605febe4a3bbaffected
  • 5.10.241 to < 5.10.261affected
  • 5.15.190 to < 5.15.212affected
  • 6.1.149 to < 6.1.178affected
  • 6.6.103 to < 6.6.145affected
  • 6.12.43 to < 6.12.97affected
  • 5.4.297 to < 5.5affected
  • 6.15.11 to < 6.16affected
  • 6.16.2 to < 6.17affected

Linux Linux

Default version status: affected

  • 6.17affected
  • 0 to < 6.17unaffected
  • 5.10.261 to ≤ 5.10.*unaffected
  • 5.15.212 to ≤ 5.15.*unaffected
  • 6.1.178 to ≤ 6.1.*unaffected
  • 6.6.145 to ≤ 6.6.*unaffected
  • 6.12.97 to ≤ 6.12.*unaffected
  • 6.18.40 to ≤ 6.18.*unaffected
  • 7.1.4 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References