PT-2026-64582 · Linux · Linux

CVE-2026-64361 · Publicado 2026-07-25 · Atualizado 2026-07-25

NVD

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

hfs/hfsplus: fix u32 overflow in check and correct requested length

check and correct requested length() compares (off + len) against node size using u32 arithmetic. When the caller passes a large len value (e.g. from an underflowed subtraction in hfs brec remove()), off + len can wrap past 2^32 and produce a small result, causing the bounds check to pass when it should fail.

For example, with off=14 and len=0xFFFFFFF2 (underflowed from data off - keyoffset - size in hfs brec remove), off + len wraps to 6, which is less than a typical node size of 512, so the check passes and the subsequent memmove reads ~4GB past the node buffer.

Fix this by widening the addition to u64 before comparing against node size. This prevents the u32 wrap while keeping the logic straightforward.

Correção

Identificadores relacionados

CVE-2026-64361

Produtos afetados

Linux

Referências · 9

• https://git.kernel.org/stable/c/607217f7ad419b53926f71e3f75001813bbc08ad · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-64361 · Nota de Segurança
• https://git.kernel.org/stable/c/966cb76fb2857a4242cab6ea2ea17acf818a3da7 · Nota
• https://git.kernel.org/stable/c/fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1 · Nota
• https://git.kernel.org/stable/c/7399c3baee7bb622a92f0b895cd4d3009a693f2b · Nota
• https://git.kernel.org/stable/c/671c3fcc2ad31c1311ea6414382a2d95104ae1b9 · Nota
• https://git.kernel.org/stable/c/c25d3c931a63e762fcaa9cb125b901c53b62403f · Nota
• https://git.kernel.org/stable/c/c8dd112173c02adf539fe2ad34a45f5e0068780d · Nota
• https://git.kernel.org/stable/c/b6a481642ea1977be2f84dc08c5affd742c177e7 · Nota