CVE-2026-80656

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: Add a sanity check for btree node size

Syzbot reported an uninit-value bug in [1] with a corrupted HFS+ image,

during the file system mounting process, specifically while loading the

catalog, a corrupted node_size value of 1 caused the rec_off argument

passed to hfs_bnode_read_u16() (within hfs_bnode_find()) to be excessively

large. Consequently, the function failed to return a valid value to

initialize the off variable, triggering the bug [1].

Every node starts from BTree node descriptor: struct hfs_bnode_desc.

So, the size of node cannot be lesser than that. However, technical

specification declares that: "The node size (which is expressed in bytes)

must be power of two, from 512 through 32,768, inclusive." Add a check

for btree node size base on technical specification.

[1]

BUG: KMSAN: uninit-value in hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584

hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bn

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References