CVE-2026-64360 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
hfs_bnode_read() can return early without writing to the output buffer when is_bnode_offset_valid() fails or when check_and_correct_requested_ length() corrects the length to zero. Callers such as hfs_bnode_read_ u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the result unconditionally, leading to KMSAN uninit-value reports.
Rather than initializing at each individual call site, zero the buffer at the start of hfs_bnode_read() before any validation checks. This ensures all callers in both hfs and hfsplus get a deterministic zero value regardless of which early-return path is taken.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability identified in the Linux kernel's HFS and HFS+ file system implementations stems from improper buffer initialization within the hfs_bnode_read() function, creating a potential vector for uninitialized memory access that could lead to security implications. This flaw affects the handling of buffer operations during file system read operations where the function may exit prematurely without properly initializing the output buffer before returning control to callers. The issue manifests when the is_bnode_offset_valid() validation fails or when check_and_correct_requested_length() adjusts the requested length to zero, causing the function to return early while leaving the buffer in an uninitialized state.
The technical implementation flaw resides in the function's control flow where multiple early return paths exist without ensuring buffer initialization occurs before the function exits. When hfs_bnode_read() encounters validation failures or length correction scenarios, it returns without writing any data to the output buffer, yet callers such as hfs_bnode_read_u16() and hfs_bnode_read_u8() rely on these buffers being populated with valid data. Since these callers use stack-allocated buffers and process the returned data unconditionally, the uninitialized memory contents can be interpreted as meaningful data, creating a potential information disclosure or exploitation vector. This pattern directly violates the principle of least privilege and proper resource initialization that security-conscious code should maintain.
The operational impact of this vulnerability extends beyond simple information leakage to potentially enable more sophisticated attacks through uninitialized memory corruption. When KMSAN (Kernel Memory Sanitizer) reports uninit-value errors, it indicates that kernel memory operations are accessing data that has not been properly initialized, which could allow attackers to infer sensitive information from memory contents or manipulate program execution flow. The vulnerability affects both HFS and HFS+ implementations within the Linux kernel, meaning that systems running these file systems are at risk regardless of which specific implementation is in use. This creates a widespread impact across various Linux distributions and kernel versions where HFS support has been enabled.
The proposed mitigation strategy addresses this issue by implementing zero-initialization of buffers at the function entry point rather than attempting to handle initialization at each individual call site. This approach ensures that regardless of which early-return path is taken, all callers receive a deterministic zero value in their output buffers, eliminating the uninitialized memory access vectors. The solution aligns with security best practices and follows the principle of defensive programming where resources are properly initialized before use. This change directly addresses the underlying CWE-457: Use of Uninitialized Variable vulnerability category and helps prevent potential exploitation through information leakage or memory corruption attacks.
The fix demonstrates proper adherence to kernel security standards by ensuring that all kernel functions maintain deterministic behavior even when encountering error conditions. By implementing buffer zero-initialization at the function entry point, the solution prevents attackers from potentially exploiting uninitialized memory contents while maintaining the expected functionality of the file system operations. This approach also reduces code complexity and maintenance overhead since initialization logic is centralized rather than scattered across multiple call sites. The mitigation effectively closes potential attack vectors that could be leveraged through the ATT&CK framework's information gathering techniques, specifically addressing the risk of information disclosure through uninitialized memory access patterns in kernel space operations.