PT-2026-64582 · Linux · Linux

CVE-2026-64361 · Published 2026-07-25 · Updated 2026-07-25

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

hfs/hfsplus: fix u32 overflow in check and correct requested length

check and correct requested length() compares (off + len) against node size using u32 arithmetic. When the caller passes a large len value (e.g. from an underflowed subtraction in hfs brec remove()), off + len can wrap past 2^32 and produce a small result, causing the bounds check to pass when it should fail.

For example, with off=14 and len=0xFFFFFFF2 (underflowed from data off - keyoffset - size in hfs brec remove), off + len wraps to 6, which is less than a typical node size of 512, so the check passes and the subsequent memmove reads ~4GB past the node buffer.

Fix this by widening the addition to u64 before comparing against node size. This prevents the u32 wrap while keeping the logic straightforward.

Fix

Related Identifiers

CVE-2026-64361

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-64361 · Security Note
• https://git.kernel.org/stable/c/607217f7ad419b53926f71e3f75001813bbc08ad · Note
• https://git.kernel.org/stable/c/966cb76fb2857a4242cab6ea2ea17acf818a3da7 · Note
• https://git.kernel.org/stable/c/fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1 · Note
• https://git.kernel.org/stable/c/7399c3baee7bb622a92f0b895cd4d3009a693f2b · Note
• https://git.kernel.org/stable/c/671c3fcc2ad31c1311ea6414382a2d95104ae1b9 · Note
• https://git.kernel.org/stable/c/c25d3c931a63e762fcaa9cb125b901c53b62403f · Note
• https://git.kernel.org/stable/c/c8dd112173c02adf539fe2ad34a45f5e0068780d · Note
• https://git.kernel.org/stable/c/b6a481642ea1977be2f84dc08c5affd742c177e7 · Note