CVE-2026-46169

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: fix uninit-value by validating catalog record size

Syzbot reported a KMSAN uninit-value issue in hfsplus_strcasecmp(). The

root cause is that hfs_brec_read() doesn't validate that the on-disk

record size matches the expected size for the record type being read.

When mounting a corrupted filesystem, hfs_brec_read() may read less data

than expected. For example, when reading a catalog thread record, the

debug output showed:

HFSPLUS_BREC_READ: rec_len=520, fd->entrylength=26

HFSPLUS_BREC_READ: WARNING - entrylength (26) < rec_len (520) - PARTIAL READ!

hfs_brec_read() only validates that entrylength is not greater than the

buffer size, but doesn't check if it's less than expected. It successfully

reads 26 bytes into a 520-byte structure and returns success, leaving 494

bytes uninitialized.

This uninitialized data in tmp.thread.nodeName then gets copied by

hfsplus_cat_build_key_uni() and used by hfsplus_s

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References