What is the CVSS score of CVE-2026-80656?

CVE-2026-80656 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-80656?

Organizations running Linux systems with HFS+ filesystem support face potential data breach or system instability risks from CVE-2026-80656, a kernel-level vulnerability in the HFS+ driver.. A patch is available.

How to fix or mitigate CVE-2026-80656?

Within 24 hours: inventory Linux systems running vulnerable kernel versions with HFS+ support enabled; check git.kernel.org for applicable patch versions. Within 7 days: apply available vendor patches to all identified systems; if HFS+ filesystem support is not operationally required, consider disabling the driver module to eliminate exposure. Within 30 days: establish automated kernel update processes and conduct validation testing on patched systems to confirm stability and mitigation effectiveness.

Linux Kernel CVE-2026-80656

EUVD-2026-67532 HIGH

2026-08-28 Linux

GHSA-prqf-3j7q-v843

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Requires local filesystem-mount capability (AV:L, PR:L); uninitialized kernel memory read justifies C:H/I:H/A:H with no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 29, 2026 - 07:47 vuln.today

CVSS changed

Aug 29, 2026 - 07:22 NVD

7.8 (HIGH)

Patch available

Aug 28, 2026 - 09:02 EUVD

CVE Published

Aug 28, 2026 - 06:49 cve.org

HIGH 7.8

CVE Published

Aug 28, 2026 - 06:49 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: Add a sanity check for btree node size

Syzbot reported an uninit-value bug in [1] with a corrupted HFS+ image, during the file system mounting process, specifically while loading the catalog, a corrupted node_size value of 1 caused the rec_off argument passed to hfs_bnode_read_u16() (within hfs_bnode_find()) to be excessively large. Consequently, the function failed to return a valid value to initialize the off variable, triggering the bug [1].

Every node starts from BTree node descriptor: struct hfs_bnode_desc. So, the size of node cannot be lesser than that. However, technical specification declares that: "The node size (which is expressed in bytes) must be power of two, from 512 through 32,768, inclusive." Add a check for btree node size base on technical specification.

[1] BUG: KMSAN: uninit-value in hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584 hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584 hfsplus_btree_open+0x169a/0x1e40 fs/hfsplus/btree.c:382 hfsplus_fill_super+0x111f/0x2770 fs/hfsplus/super.c:553 get_tree_bdev_flags+0x6e6/0x920 fs/super.c:1694 get_tree_bdev+0x38/0x50 fs/super.c:1717 hfsplus_get_tree+0x35/0x40 fs/hfsplus/super.c:709 vfs_get_tree+0xb3/0x5d0 fs/super.c:1754 fc_mount fs/namespace.c:1193 [inline]

AnalysisAI

Uninitialized-value access in the Linux kernel's HFS+ filesystem driver allows a local attacker with mount privileges to trigger kernel memory corruption or information disclosure by supplying a crafted disk image containing an invalid btree node_size. The flaw is reached during the mount path - specifically in hfsplus_bnode_find() while loading the HFS+ catalog B-tree - when a corrupted node_size value (e.g., 1) causes an excessively large offset to be passed to hfs_bnode_read_u16(), resulting in use of uninitialized stack memory. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires local system access with the capability to mount filesystems - corresponding to PR:L in the CVSS vector, typically requiring CAP_SYS_ADMIN or an enabled unprivileged mount namespace (the latter is distribution-dependent; some distributions restrict this by default). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects substantial potential impact - kernel-level uninitialized memory exposure can yield information disclosure, kernel panic, or, depending on how the uninitialized value propagates through control flow, possible code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply one of the two upstream stable-tree patches: commit 3f95e2661574ff13f099dd13456751933c280628 (https://git.kernel.org/stable/c/3f95e2661574ff13f099dd13456751933c280628) or commit 306265eb9384d2c224f1b14d83a29323f0eab6d1 (https://git.kernel.org/stable/c/306265eb9384d2c224f1b14d83a29323f0eab6d1), which add a btree node size sanity check enforcing the HFS+ specification requirement - node_size must be a power of two between 512 and 32,768 bytes. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: inventory Linux systems running vulnerable kernel versions with HFS+ support enabled; check git.kernel.org for applicable patch versions. …

Threat intelligence, references, and detailed analysis are available after sign-in.