hfs/hfsplus: zero-initialize buffer in hfs_bnode_read (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.12 % · percentile 2 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: zero-initialize buffer in hfs_bnode_read hfs_bnode_read() can return early without writing to the output buffer when is_bnode_offset_valid() fails or when check_and_correct_requested_ length() corrects the length to zero. Callers such as hfs_bnode_read_ u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the result unconditionally, leading to KMSAN uninit-value reports. Rather than initializing at each individual call site, zero the buffer at the start of hfs_bnode_read() before any validation checks. This ensures all callers in both hfs and hfsplus get a deterministic zero value regardless of which early-return path is taken.
Weaknesses (CWE)
- CWE-908 — Use of Uninitialized Resource
References
- https://git.kernel.org/stable/c/34684a04777358b2b40ac729e54c8e45359e46b3
- https://git.kernel.org/stable/c/0b189b2204f1a2612dc68f8d139fb5b80539e710
- https://git.kernel.org/stable/c/8f72fd25a57a457866350359ddd27a43caa62c95
- https://git.kernel.org/stable/c/16ca053c2be5f4f3044dccf7fc19237dc820d394
- https://git.kernel.org/stable/c/d2afc7ecee476f9251dd87444f7fb6a424410922
- https://git.kernel.org/stable/c/f3461b84a4865d9b5e70fbb71da72ae044a3bcd2
- https://git.kernel.org/stable/c/d5b45bad75cd2730b8452aed4d3b20a2b2a12576
- https://git.kernel.org/stable/c/d67aadee19ffdf3cc8520c5a4f4d5b2916d30baf
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2026-48904
- GCVE · GCVE-0-2026-64360
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1252 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1229 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1203 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1162 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1031 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0982 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.297 < 5.5cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10.241 < 5.10.261cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.190 < 5.15.212cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.1.149 < 6.1.178cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.6.103 < 6.6.145cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.12.43 < 6.12.96cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.15.11 < 6.16cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.16.2 < 6.18.39cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 7.1.4
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 67ecc81f6492275c9c54280532f558483c99c90e < 34684a04777358b2b40ac729e54c8e45359e46b3 ; affected a1a60e79502279f996e55052f50cc14919020475 < 0b189b2204f1a2612dc68f8d139fb5b80539e710 ; affected fe2891a9c43ab87d1a210d61e6438ca6936e2f62 < 8f72fd25a57a457866350359ddd27a43caa62c95 ; affected 384a66b89f9540a9a8cb0f48807697dfabaece4c < 16ca053c2be5f4f3044dccf7fc19237dc820d394 ; affected efc095b35b23297e419c2ab4fc1ed1a8f0781a29 < d2afc7ecee476f9251dd87444f7fb6a424410922 ; affected a431930c9bac518bf99d6b1da526a7f37ddee8d8 < f3461b84a4865d9b5e70fbb71da72ae044a3bcd2 |
| Linux · Linux | affected 6.17 ; unaffected 0 < 6.17 ; unaffected 5.10.261 ≤ 5.10.* ; unaffected 5.15.212 ≤ 5.15.* ; unaffected 6.1.178 ≤ 6.1.* ; unaffected 6.6.145 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |