Skip to main content

Linux Kernel EUVDEUVD-2026-48904

| CVE-2026-64360 MEDIUM
Use of Uninitialized Resource (CWE-908)
2026-07-25 Linux GHSA-7hfv-j3wg-pj3f
Denial Of Service Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local mount privilege required to trigger HFS/HFS+ code path; impact is kernel crash only, with no confidentiality or integrity loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 04, 2026 - 16:40 vuln.today
tag: Denial Of Service added
Analysis Generated
Sep 04, 2026 - 16:15 vuln.today
CVSS changed
Sep 04, 2026 - 16:07 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 25, 2026 - 08:50 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

hfs/hfsplus: zero-initialize buffer in hfs_bnode_read

hfs_bnode_read() can return early without writing to the output buffer when is_bnode_offset_valid() fails or when check_and_correct_requested_ length() corrects the length to zero. Callers such as hfs_bnode_read_ u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the result unconditionally, leading to KMSAN uninit-value reports.

Rather than initializing at each individual call site, zero the buffer at the start of hfs_bnode_read() before any validation checks. This ensures all callers in both hfs and hfsplus get a deterministic zero value regardless of which early-return path is taken.

AnalysisAI

Uninitialized stack memory use in the Linux kernel HFS and HFS+ filesystem drivers allows a local user to crash the kernel by mounting a crafted filesystem image. Two early-exit paths in hfs_bnode_read() - an invalid offset check and a corrected-to-zero length - skip the buffer write, while downstream callers such as hfs_bnode_read_u16() and hfs_bnode_read_u8() consume the uninitialized stack buffer unconditionally, producing KMSAN uninit-value reports and risking kernel panics. Patches are available across multiple stable kernel branches; no public exploit exists and EPSS is very low at 0.22%.

Technical ContextAI

The vulnerability resides in fs/hfs/bnode.c and fs/hfsplus/bnode.c within the Linux kernel, affecting the drivers for Apple's legacy HFS and HFS+ (Mac OS Extended) filesystems. CWE-908 (Use of Uninitialized Resource) is the root cause: hfs_bnode_read() is designed to populate a caller-supplied buffer from the page cache, but two code paths - is_bnode_offset_valid() returning false, and check_and_correct_requested_length() reducing the requested length to zero - cause the function to return before writing anything to the output buffer. Higher-level wrappers like hfs_bnode_read_u16() and hfs_bnode_read_u8() allocate these buffers on the stack and pass them in, then use the returned values unconditionally regardless of whether the read actually occurred. Because stack memory is not zero-initialized by default, the values contain whatever happened to be on the stack previously. The fix zero-initializes the buffer at the start of hfs_bnode_read() before any validation, ensuring a deterministic zero value on all early-exit paths. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Apply upstream stable-tree patches available at git.kernel.org: commits 34684a04, 0b189b22, 8f72fd25, 16ca053c, d2afc7ee, f3461b84, d5b45bad, and d67aadee. Confirmed patched stable releases include Linux 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc1; distributions should deliver these via normal kernel update channels. For systems that do not require HFS or HFS+ filesystem support - the vast majority of Linux servers - blacklist the modules as a compensating control: add install hfs /bin/false and install hfsplus /bin/false to /etc/modprobe.d/disable-hfs.conf and regenerate initramfs. This prevents any user from loading the vulnerable drivers and has no operational impact on non-Apple-filesystem workloads. Systems with kernel.modules_disabled=1 and without these modules compiled in are unaffected.

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

EUVD-2026-48904 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy