CVE-2026-80656 (GCVE-0-2026-80656)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:49 – Updated: 2026-08-29 06:21
VLAI
Title
hfsplus: Add a sanity check for btree node size
Summary
In the Linux kernel, the following vulnerability has been resolved: hfsplus: Add a sanity check for btree node size Syzbot reported an uninit-value bug in [1] with a corrupted HFS+ image, during the file system mounting process, specifically while loading the catalog, a corrupted node_size value of 1 caused the rec_off argument passed to hfs_bnode_read_u16() (within hfs_bnode_find()) to be excessively large. Consequently, the function failed to return a valid value to initialize the off variable, triggering the bug [1]. Every node starts from BTree node descriptor: struct hfs_bnode_desc. So, the size of node cannot be lesser than that. However, technical specification declares that: "The node size (which is expressed in bytes) must be power of two, from 512 through 32,768, inclusive." Add a check for btree node size base on technical specification. [1] BUG: KMSAN: uninit-value in hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584 hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584 hfsplus_btree_open+0x169a/0x1e40 fs/hfsplus/btree.c:382 hfsplus_fill_super+0x111f/0x2770 fs/hfsplus/super.c:553 get_tree_bdev_flags+0x6e6/0x920 fs/super.c:1694 get_tree_bdev+0x38/0x50 fs/super.c:1717 hfsplus_get_tree+0x35/0x40 fs/hfsplus/super.c:709 vfs_get_tree+0xb3/0x5d0 fs/super.c:1754 fc_mount fs/namespace.c:1193 [inline]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8ad2c6a36ac4328072377906a47ea0bff11e4032 , < 306265eb9384d2c224f1b14d83a29323f0eab6d1 (git)
Affected: 8ad2c6a36ac4328072377906a47ea0bff11e4032 , < 3f95e2661574ff13f099dd13456751933c280628 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/hfsplus/btree.c",
            "include/linux/hfs_common.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "306265eb9384d2c224f1b14d83a29323f0eab6d1",
              "status": "affected",
              "version": "8ad2c6a36ac4328072377906a47ea0bff11e4032",
              "versionType": "git"
            },
            {
              "lessThan": "3f95e2661574ff13f099dd13456751933c280628",
              "status": "affected",
              "version": "8ad2c6a36ac4328072377906a47ea0bff11e4032",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/hfsplus/btree.c",
            "include/linux/hfs_common.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: Add a sanity check for btree node size\n\nSyzbot reported an uninit-value bug in [1] with a corrupted HFS+ image,\nduring the file system mounting process, specifically while loading the\ncatalog, a corrupted node_size value of 1 caused the rec_off argument\npassed to hfs_bnode_read_u16() (within hfs_bnode_find()) to be excessively\nlarge. Consequently, the function failed to return a valid value to\ninitialize the off variable, triggering the bug [1].\n\nEvery node starts from BTree node descriptor: struct hfs_bnode_desc.\nSo, the size of node cannot be lesser than that. However, technical\nspecification declares that: \"The node size (which is expressed in bytes)\nmust be power of two, from 512 through 32,768, inclusive.\" Add a check\nfor btree node size base on technical specification.\n\n[1]\nBUG: KMSAN: uninit-value in hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584\n hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584\n hfsplus_btree_open+0x169a/0x1e40 fs/hfsplus/btree.c:382\n hfsplus_fill_super+0x111f/0x2770 fs/hfsplus/super.c:553\n get_tree_bdev_flags+0x6e6/0x920 fs/super.c:1694\n get_tree_bdev+0x38/0x50 fs/super.c:1717\n hfsplus_get_tree+0x35/0x40 fs/hfsplus/super.c:709\n vfs_get_tree+0xb3/0x5d0 fs/super.c:1754\n fc_mount fs/namespace.c:1193 [inline]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable hfs_btree_open\u2192hfs_bnode_find path is reached only via local mount(2)/vfs_get_tree on a block/loop/USB device (hfsplus_fill_super); there is no network-facing consumer of hfsplus btree parsing.\nAC:L - A crafted on-disk btree header node_size of 1 is a valid power-of-two and deterministically makes rec_off negative (wrapped to a huge u32), so hfs_bnode_read_u16 skips filling its stack buffer and KMSAN reports uninit-value at mount without races or external preconditions.\nPR:L - hfsplus is FS_REQUIRES_DEV without FS_USERNS_MOUNT; the highest-impact scenario is an unprivileged local user supplying an HFS+ USB/SD image that udisks2 or a desktop automounter mounts, or a loop image attached through session polkit helpers\u2014no real root in init_ns is needed by the attacker.\nUI:N - The attacker inserts removable media or supplies the image that gets mounted; mount-time catalog/extent btree loading fires automatically during fill_super with no separate victim action beyond routine automount behavior.\nS:U - Uninitialized-value consumption and any mount-time parser fault stay within the host kernel parsing the attacker\u0027s filesystem; no VM escape, IOMMU bypass, or sandbox boundary is crossed.\nC:H - Before the fix, invalid node_size lets hfs_bnode_read return without initializing the hfs_bnode_read_u16 buffer; the resulting garbage off value drives subsequent btree record-offset parsing and bounded node reads that consume uninitialized stack bytes\u2014a memory-safety defect class treated as arbitrary read potential per kernel CVSS guidance.\nI:H - Attacker-controlled sub-512 power-of-two node_size corrupts btree rec_off arithmetic; uninitialized or crafted record offsets can pass hfs_bnode_find checks and seed inconsistent in-memory btree nodes whose corrupted offsets propagate into further mount-time bmap and page-cache accesses.\nA:H - Syzbot/KMSAN builds panic on the uninit-value at hfsplus_bnode_find; even on production kernels a crafted image causes mount failure after kernel error logging, and repeated automount of malicious removable media can deny access to the volume and waste mount resources."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:21:45.266Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/306265eb9384d2c224f1b14d83a29323f0eab6d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f95e2661574ff13f099dd13456751933c280628"
        }
      ],
      "title": "hfsplus: Add a sanity check for btree node size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80656",
    "datePublished": "2026-08-28T06:49:02.596Z",
    "dateReserved": "2026-08-26T14:34:25.780Z",
    "dateUpdated": "2026-08-29T06:21:45.266Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80656",
      "date": "2026-09-22",
      "epss": "0.0012",
      "percentile": "0.02117"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/hfsplus/btree.c",
                  "include/linux/hfs_common.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "306265eb9384d2c224f1b14d83a29323f0eab6d1",
                    "status": "affected",
                    "version": "8ad2c6a36ac4328072377906a47ea0bff11e4032",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3f95e2661574ff13f099dd13456751933c280628",
                    "status": "affected",
                    "version": "8ad2c6a36ac4328072377906a47ea0bff11e4032",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/hfsplus/btree.c",
                  "include/linux/hfs_common.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: Add a sanity check for btree node size\n\nSyzbot reported an uninit-value bug in [1] with a corrupted HFS+ image,\nduring the file system mounting process, specifically while loading the\ncatalog, a corrupted node_size value of 1 caused the rec_off argument\npassed to hfs_bnode_read_u16() (within hfs_bnode_find()) to be excessively\nlarge. Consequently, the function failed to return a valid value to\ninitialize the off variable, triggering the bug [1].\n\nEvery node starts from BTree node descriptor: struct hfs_bnode_desc.\nSo, the size of node cannot be lesser than that. However, technical\nspecification declares that: \"The node size (which is expressed in bytes)\nmust be power of two, from 512 through 32,768, inclusive.\" Add a check\nfor btree node size base on technical specification.\n\n[1]\nBUG: KMSAN: uninit-value in hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584\n hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584\n hfsplus_btree_open+0x169a/0x1e40 fs/hfsplus/btree.c:382\n hfsplus_fill_super+0x111f/0x2770 fs/hfsplus/super.c:553\n get_tree_bdev_flags+0x6e6/0x920 fs/super.c:1694\n get_tree_bdev+0x38/0x50 fs/super.c:1717\n hfsplus_get_tree+0x35/0x40 fs/hfsplus/super.c:709\n vfs_get_tree+0xb3/0x5d0 fs/super.c:1754\n fc_mount fs/namespace.c:1193 [inline]"
          }
        ],
        "id": "CVE-2026-80656",
        "lastModified": "2026-08-29T07:16:48.437",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-28T08:16:50.700",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/306265eb9384d2c224f1b14d83a29323f0eab6d1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3f95e2661574ff13f099dd13456751933c280628"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T14:57:23+00:00",
      "cve": "CVE-2026-80656",
      "id": "CVE-2026-80656",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: hfsplus: Add a sanity check for btree node size",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80656.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T16:35:03Z",
      "cve": "CVE-2026-80656",
      "id": "CVE-2026-80656",
      "initial_release_date": "2026-08-28T16:35:03Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80656",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80656.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.