CVE-2026-64361 (GCVE-0-2026-64361)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:54
VLAI
Title
hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
Summary
In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length check_and_correct_requested_length() compares (off + len) against node_size using u32 arithmetic. When the caller passes a large len value (e.g. from an underflowed subtraction in hfs_brec_remove()), off + len can wrap past 2^32 and produce a small result, causing the bounds check to pass when it should fail. For example, with off=14 and len=0xFFFFFFF2 (underflowed from data_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6, which is less than a typical node_size of 512, so the check passes and the subsequent memmove reads ~4GB past the node buffer. Fix this by widening the addition to u64 before comparing against node_size. This prevents the u32 wrap while keeping the logic straightforward.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 67ecc81f6492275c9c54280532f558483c99c90e , < c8dd112173c02adf539fe2ad34a45f5e0068780d (git)
Affected: a1a60e79502279f996e55052f50cc14919020475 , < fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1 (git)
Affected: fe2891a9c43ab87d1a210d61e6438ca6936e2f62 , < 671c3fcc2ad31c1311ea6414382a2d95104ae1b9 (git)
Affected: 384a66b89f9540a9a8cb0f48807697dfabaece4c , < b6a481642ea1977be2f84dc08c5affd742c177e7 (git)
Affected: efc095b35b23297e419c2ab4fc1ed1a8f0781a29 , < 7399c3baee7bb622a92f0b895cd4d3009a693f2b (git)
Affected: a431930c9bac518bf99d6b1da526a7f37ddee8d8 , < 607217f7ad419b53926f71e3f75001813bbc08ad (git)
Affected: a431930c9bac518bf99d6b1da526a7f37ddee8d8 , < c25d3c931a63e762fcaa9cb125b901c53b62403f (git)
Affected: a431930c9bac518bf99d6b1da526a7f37ddee8d8 , < 966cb76fb2857a4242cab6ea2ea17acf818a3da7 (git)
Affected: e7d2dc2421e821e4045775e6dc226378328de6f6 (git)
Affected: fc7f732984ec91f30be3e574e0644066d07f2b78 (git)
Affected: eec522fd0d28106b14a59ab2d658605febe4a3bb (git)
Affected: 5.10.241 , < 5.10.261 (semver)
Affected: 5.15.190 , < 5.15.212 (semver)
Affected: 6.1.149 , < 6.1.178 (semver)
Affected: 6.6.103 , < 6.6.145 (semver)
Affected: 6.12.43 , < 6.12.97 (semver)
Affected: 5.4.297 , < 5.5 (semver)
Affected: 6.15.11 , < 6.16 (semver)
Affected: 6.16.2 , < 6.17 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/hfs/bnode.c",
            "fs/hfsplus/hfsplus_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c8dd112173c02adf539fe2ad34a45f5e0068780d",
              "status": "affected",
              "version": "67ecc81f6492275c9c54280532f558483c99c90e",
              "versionType": "git"
            },
            {
              "lessThan": "fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1",
              "status": "affected",
              "version": "a1a60e79502279f996e55052f50cc14919020475",
              "versionType": "git"
            },
            {
              "lessThan": "671c3fcc2ad31c1311ea6414382a2d95104ae1b9",
              "status": "affected",
              "version": "fe2891a9c43ab87d1a210d61e6438ca6936e2f62",
              "versionType": "git"
            },
            {
              "lessThan": "b6a481642ea1977be2f84dc08c5affd742c177e7",
              "status": "affected",
              "version": "384a66b89f9540a9a8cb0f48807697dfabaece4c",
              "versionType": "git"
            },
            {
              "lessThan": "7399c3baee7bb622a92f0b895cd4d3009a693f2b",
              "status": "affected",
              "version": "efc095b35b23297e419c2ab4fc1ed1a8f0781a29",
              "versionType": "git"
            },
            {
              "lessThan": "607217f7ad419b53926f71e3f75001813bbc08ad",
              "status": "affected",
              "version": "a431930c9bac518bf99d6b1da526a7f37ddee8d8",
              "versionType": "git"
            },
            {
              "lessThan": "c25d3c931a63e762fcaa9cb125b901c53b62403f",
              "status": "affected",
              "version": "a431930c9bac518bf99d6b1da526a7f37ddee8d8",
              "versionType": "git"
            },
            {
              "lessThan": "966cb76fb2857a4242cab6ea2ea17acf818a3da7",
              "status": "affected",
              "version": "a431930c9bac518bf99d6b1da526a7f37ddee8d8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e7d2dc2421e821e4045775e6dc226378328de6f6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fc7f732984ec91f30be3e574e0644066d07f2b78",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eec522fd0d28106b14a59ab2d658605febe4a3bb",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.261",
              "status": "affected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.212",
              "status": "affected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.178",
              "status": "affected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.97",
              "status": "affected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThan": "6.16",
              "status": "affected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThan": "6.17",
              "status": "affected",
              "version": "6.16.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/hfs/bnode.c",
            "fs/hfsplus/hfsplus_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.10.241",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15.190",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.1.149",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.103",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.12.43",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.297",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.15.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.16.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs/hfsplus: fix u32 overflow in check_and_correct_requested_length\n\ncheck_and_correct_requested_length() compares (off + len) against\nnode_size using u32 arithmetic.  When the caller passes a large len\nvalue (e.g. from an underflowed subtraction in hfs_brec_remove()),\noff + len can wrap past 2^32 and produce a small result, causing the\nbounds check to pass when it should fail.\n\nFor example, with off=14 and len=0xFFFFFFF2 (underflowed from\ndata_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6,\nwhich is less than a typical node_size of 512, so the check passes and\nthe subsequent memmove reads ~4GB past the node buffer.\n\nFix this by widening the addition to u64 before comparing against\nnode_size.  This prevents the u32 wrap while keeping the logic\nstraightforward."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable HFS/HFS+ B-tree operations are reachable through local filesystem syscalls such as removexattr() and rename() after a crafted volume is mounted. No network protocol directly supplies the malformed B-tree metadata.\nAC:L - A crafted B-tree deterministically produces the length underflow and u32 addition wrap; no race or condition outside the attacker\u0027s control is required.\nPR:L - Although mounting HFS/HFS+ requires init-namespace CAP_SYS_ADMIN, an unprivileged user with ordinary write access to a file on an already mounted crafted volume can trigger the flaw through user.* xattr removal or permitted rename operations.\nUI:N - The attacker can invoke the triggering filesystem syscall directly once the crafted volume is mounted; no action by another user is required.\nS:U - The corruption occurs in the kernel while processing filesystem metadata and does not cross a separate virtualization, IOMMU, or other security authority boundary.\nC:H - The wrapped near-4-GiB copy performs out-of-bounds reads and, in HFS+, can walk beyond the node\u0027s page-pointer array, providing a defensible path to broad kernel-memory disclosure.\nI:H - The affected move, copy, clear, and write paths can write beyond the B-tree node buffer; the huge memmove is therefore exploitable memory corruption rather than a read-only crash.\nA:H - The enormous out-of-bounds memory operation can reliably cause a kernel oops or panic and can corrupt large regions of kernel memory, producing complete system unavailability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:07.849Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c8dd112173c02adf539fe2ad34a45f5e0068780d"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/671c3fcc2ad31c1311ea6414382a2d95104ae1b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6a481642ea1977be2f84dc08c5affd742c177e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/7399c3baee7bb622a92f0b895cd4d3009a693f2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/607217f7ad419b53926f71e3f75001813bbc08ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/c25d3c931a63e762fcaa9cb125b901c53b62403f"
        },
        {
          "url": "https://git.kernel.org/stable/c/966cb76fb2857a4242cab6ea2ea17acf818a3da7"
        }
      ],
      "title": "hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64361",
    "datePublished": "2026-07-25T08:50:17.345Z",
    "dateReserved": "2026-07-19T15:36:31.783Z",
    "dateUpdated": "2026-08-17T04:54:07.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64361",
      "date": "2026-09-21",
      "epss": "0.00129",
      "percentile": "0.02947"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:50:40.000Z",
      "cve": "CVE-2026-64361",
      "id": "msrc_CVE-2026-64361",
      "initial_release_date": "2026-07-26T01:08:26.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64361.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/hfs/bnode.c",
                  "fs/hfsplus/hfsplus_fs.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c8dd112173c02adf539fe2ad34a45f5e0068780d",
                    "status": "affected",
                    "version": "67ecc81f6492275c9c54280532f558483c99c90e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1",
                    "status": "affected",
                    "version": "a1a60e79502279f996e55052f50cc14919020475",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "671c3fcc2ad31c1311ea6414382a2d95104ae1b9",
                    "status": "affected",
                    "version": "fe2891a9c43ab87d1a210d61e6438ca6936e2f62",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b6a481642ea1977be2f84dc08c5affd742c177e7",
                    "status": "affected",
                    "version": "384a66b89f9540a9a8cb0f48807697dfabaece4c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7399c3baee7bb622a92f0b895cd4d3009a693f2b",
                    "status": "affected",
                    "version": "efc095b35b23297e419c2ab4fc1ed1a8f0781a29",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "607217f7ad419b53926f71e3f75001813bbc08ad",
                    "status": "affected",
                    "version": "a431930c9bac518bf99d6b1da526a7f37ddee8d8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c25d3c931a63e762fcaa9cb125b901c53b62403f",
                    "status": "affected",
                    "version": "a431930c9bac518bf99d6b1da526a7f37ddee8d8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "966cb76fb2857a4242cab6ea2ea17acf818a3da7",
                    "status": "affected",
                    "version": "a431930c9bac518bf99d6b1da526a7f37ddee8d8",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "e7d2dc2421e821e4045775e6dc226378328de6f6",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "fc7f732984ec91f30be3e574e0644066d07f2b78",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "eec522fd0d28106b14a59ab2d658605febe4a3bb",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.10.261",
                    "status": "affected",
                    "version": "5.10.241",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.15.212",
                    "status": "affected",
                    "version": "5.15.190",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.178",
                    "status": "affected",
                    "version": "6.1.149",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.145",
                    "status": "affected",
                    "version": "6.6.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12.97",
                    "status": "affected",
                    "version": "6.12.43",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "affected",
                    "version": "5.4.297",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "affected",
                    "version": "6.15.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "affected",
                    "version": "6.16.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/hfs/bnode.c",
                  "fs/hfsplus/hfsplus_fs.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.17"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6A4268E9-3297-43A5-98D3-25B38D611EF5",
                    "versionEndExcluding": "5.5",
                    "versionStartIncluding": "5.4.297",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "53448B82-A3AA-4290-BEDD-500EF591AC49",
                    "versionEndExcluding": "5.10.261",
                    "versionStartIncluding": "5.10.241",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A0292639-5CDC-403C-9726-5755863452FA",
                    "versionEndExcluding": "5.15.212",
                    "versionStartIncluding": "5.15.190",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "06108194-F1DD-4616-B8D7-EAFF02E4822A",
                    "versionEndExcluding": "6.1.178",
                    "versionStartIncluding": "6.1.149",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2C90C7B7-1E18-4314-BB4E-74CFFC3E0998",
                    "versionEndExcluding": "6.6.145",
                    "versionStartIncluding": "6.6.103",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "816F4ADA-5A7E-4CAC-A67D-FBFD4F1A9F4A",
                    "versionEndExcluding": "6.12.97",
                    "versionStartIncluding": "6.12.43",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "53FE35DC-2528-48D7-A855-1127CA02EE4D",
                    "versionEndExcluding": "6.16",
                    "versionStartIncluding": "6.15.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "52435846-D0E4-47F9-8100-FACB71F615D0",
                    "versionEndExcluding": "6.18.40",
                    "versionStartIncluding": "6.16.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
                    "versionEndExcluding": "7.1.4",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs/hfsplus: fix u32 overflow in check_and_correct_requested_length\n\ncheck_and_correct_requested_length() compares (off + len) against\nnode_size using u32 arithmetic.  When the caller passes a large len\nvalue (e.g. from an underflowed subtraction in hfs_brec_remove()),\noff + len can wrap past 2^32 and produce a small result, causing the\nbounds check to pass when it should fail.\n\nFor example, with off=14 and len=0xFFFFFFF2 (underflowed from\ndata_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6,\nwhich is less than a typical node_size of 512, so the check passes and\nthe subsequent memmove reads ~4GB past the node buffer.\n\nFix this by widening the addition to u64 before comparing against\nnode_size.  This prevents the u32 wrap while keeping the logic\nstraightforward."
          }
        ],
        "id": "CVE-2026-64361",
        "lastModified": "2026-09-04T15:57:14.170",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-25T10:17:18.677",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/607217f7ad419b53926f71e3f75001813bbc08ad"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/671c3fcc2ad31c1311ea6414382a2d95104ae1b9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7399c3baee7bb622a92f0b895cd4d3009a693f2b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/966cb76fb2857a4242cab6ea2ea17acf818a3da7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b6a481642ea1977be2f84dc08c5affd742c177e7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c25d3c931a63e762fcaa9cb125b901c53b62403f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c8dd112173c02adf539fe2ad34a45f5e0068780d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-191"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-29T16:02:57+00:00",
      "cve": "CVE-2026-64361",
      "id": "CVE-2026-64361",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64361.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-10T02:24:36Z",
      "cve": "CVE-2026-64361",
      "id": "CVE-2026-64361",
      "initial_release_date": "2026-07-25T16:01:00Z",
      "product_status:known_affected": "96",
      "product_status:known_not_affected": "280",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64361",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64361.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.