HIGH Introduced in 7.1
hfsplus BTreeNode Uninit
CVE-2026-80656
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI4.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: hfsplus: Add a sanity check for btree node size Syzbot reported an uninit-value bug in [1] with a corrupted HFS+ image, during the file system mounting process, specifically while loading the catalog, a corrupted node_size value of 1 caused the rec_off argument passed to hfs_bnode_read_u16() (within hfs_bnode_find()) to be excessively large. Consequently, the function failed to return a valid value to initialize the off variable, triggering the bug [1]. Every node starts from BTree node descriptor: struct hfs_bnode_desc. So, the size of node cannot be lesser than that. However, technical specification declares that: "The node size (which is expressed in bytes) must be power of two, from 512 through 32,768, inclusive." Add a check for btree node size base on technical specification. [1] BUG: KMSAN: uninit-value in hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584 hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584 hfsplus_btree_open+0x169a/0x1e40 fs/hfsplus/btree.c:382 hfsplus_fill_super+0x111f/0x2770 fs/hfsplus/super.c:553 get_tree_bdev_flags+0x6e6/0x920 fs/super.c:1694 get_tree_bdev+0x38/0x50 fs/super.c:1717 hfsplus_get_tree+0x35/0x40 fs/hfsplus/super.c:709 vfs_get_tree+0xb3/0x5d0 fs/super.c:1754 fc_mount fs/namespace.c:1193 [inline]
02KernelScan AI Analysis
Risk summary
Mounting a crafted HFS+ filesystem image can trigger use of uninitialized memory in the kernel during the mount process. This can lead to a kernel panic, resulting in a local denial of service. The vulnerability requires an attacker to have local access and the ability to mount a malicious filesystem image.
Vulnerability analysis
Mounting a specially crafted HFS+ filesystem image can cause the kernel to use uninitialized memory when parsing B-tree metadata. A corrupted node size value in the image bypasses existing validation, leading to an excessively large offset calculation that fails to return a valid value, leaving a variable uninitialized and triggering a kernel panic. The fix adds a sanity check during mount that rejects images with node sizes outside the technically specified range of 512 to 32,768 bytes. This vulnerability is reachable locally by any user who can mount an attacker-supplied filesystem image, which typically requires CAP_SYS_ADMIN in the initial namespace.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.1 | 7.1 | 7.1.5 | 306265eb9384 |
| mainline | 7.1 | 7.2 | 3f95e2661574 |