CVE-2026-64360

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-64360

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64360.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-64360

Downstream

Related

openSUSE-SU-2026:11476-1

Published

2026-07-25T08:50:16Z

Modified

2026-10-08T02:51:30Z

Summary

hfs/hfsplus: zero-initialize buffer in hfs_bnode_read

Details

In the Linux kernel, the following vulnerability has been resolved:

hfs/hfsplus: zero-initialize buffer in hfs_bnode_read

hfs_bnode_read() can return early without writing to the output buffer when is_bnode_offset_valid() fails or when check_and_correct_requested_ length() corrects the length to zero. Callers such as hfs_bnode_read_ u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the result unconditionally, leading to KMSAN uninit-value reports.

Rather than initializing at each individual call site, zero the buffer at the start of hfs_bnode_read() before any validation checks. This ensures all callers in both hfs and hfsplus get a deterministic zero value regardless of which early-return path is taken.

Database specific

{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64360.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

67ecc81f6492275c9c54280532f558483c99c90e

Fixed

34684a04777358b2b40ac729e54c8e45359e46b3

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

a1a60e79502279f996e55052f50cc14919020475

Fixed

0b189b2204f1a2612dc68f8d139fb5b80539e710

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

fe2891a9c43ab87d1a210d61e6438ca6936e2f62

Fixed

8f72fd25a57a457866350359ddd27a43caa62c95

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

384a66b89f9540a9a8cb0f48807697dfabaece4c

Fixed

16ca053c2be5f4f3044dccf7fc19237dc820d394

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

efc095b35b23297e419c2ab4fc1ed1a8f0781a29

Fixed

d2afc7ecee476f9251dd87444f7fb6a424410922

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

a431930c9bac518bf99d6b1da526a7f37ddee8d8

Fixed

f3461b84a4865d9b5e70fbb71da72ae044a3bcd2

Fixed

d5b45bad75cd2730b8452aed4d3b20a2b2a12576

Fixed

d67aadee19ffdf3cc8520c5a4f4d5b2916d30baf

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5.10.241

Fixed

5.10.261

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5.15.190

Fixed

5.15.212

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.1.149

Fixed

6.1.178

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.6.103

Fixed

6.6.145

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.12.43

Fixed

6.12.96

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5.4.297

Fixed

5.5

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.15.11

Fixed

6.16

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.16.2

Fixed

6.17

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

e7d2dc2421e821e4045775e6dc226378328de6f6

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

fc7f732984ec91f30be3e574e0644066d07f2b78

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

eec522fd0d28106b14a59ab2d658605febe4a3bb

Affected versions

v5.*

v5.10.241

v5.10.242

v5.10.243

v5.10.244

v5.10.245

v5.10.246

v5.10.247

v5.10.248

v5.10.249

v5.10.250

v5.10.251

v5.10.252

v5.10.253

v5.10.254

v5.10.255

v5.10.256

v5.10.257

v5.10.258

v5.10.259

v5.10.260

v5.15.190

v5.15.191

v5.15.192

v5.15.193

v5.15.194

v5.15.195

v5.15.196

v5.15.197

v5.15.198

v5.15.199

v5.15.200

v5.15.201

v5.15.202

v5.15.203

v5.15.204

v5.15.205

v5.15.206

v5.15.207

v5.15.208

v5.15.209

v5.15.210

v5.15.211

v5.4.297

v5.4.298

v5.4.299

v5.4.300

v5.4.301

v5.4.302

v6.*

v6.1.149

v6.1.150

v6.1.151

v6.1.152

v6.1.153

v6.1.154

v6.1.155

v6.1.156

v6.1.157

v6.1.158

v6.1.159

v6.1.160

v6.1.161

v6.1.162

v6.1.163

v6.1.164

v6.1.165

v6.1.166

v6.1.167

v6.1.168

v6.1.169

v6.1.170

v6.1.171

v6.1.172

v6.1.173

v6.1.174

v6.1.175

v6.1.176

v6.1.177

v6.12.43

v6.12.44

v6.12.45

v6.12.46

v6.12.47

v6.12.48

v6.12.49

v6.12.50

v6.12.51

v6.12.52

v6.12.53

v6.12.54

v6.12.55

v6.12.56

v6.12.57

v6.12.58

v6.12.59

v6.12.60

v6.12.61

v6.12.62

v6.12.63

v6.12.64

v6.12.65

v6.12.66

v6.12.67

v6.12.68

v6.12.69

v6.12.70

v6.12.71

v6.12.72

v6.12.73

v6.12.74

v6.12.75

v6.12.76

v6.12.77

v6.12.78

v6.12.79

v6.12.80

v6.12.81

v6.12.82

v6.12.83

v6.12.84

v6.12.85

v6.12.86

v6.12.87

v6.12.88

v6.12.89

v6.12.90

v6.12.91

v6.12.92

v6.12.93

v6.12.94

v6.12.95

v6.15.11

v6.16.10

v6.16.11

v6.16.12

v6.16.2

v6.16.3

v6.16.4

v6.16.5

v6.16.6

v6.16.7

v6.16.8

v6.16.9

v6.6.103

v6.6.104

v6.6.105

v6.6.106

v6.6.107

v6.6.108

v6.6.109

v6.6.110

v6.6.111

v6.6.112

v6.6.113

v6.6.114

v6.6.115

v6.6.116

v6.6.117

v6.6.118

v6.6.119

v6.6.120

v6.6.121

v6.6.122

v6.6.123

v6.6.124

v6.6.125

v6.6.126

v6.6.127

v6.6.128

v6.6.129

v6.6.130

v6.6.131

v6.6.132

v6.6.133

v6.6.134

v6.6.135

v6.6.136

v6.6.137

v6.6.138

v6.6.139

v6.6.140

v6.6.141

v6.6.142

v6.6.143

v6.6.144

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64360.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.10.261

Type: ECOSYSTEM
Events: Introduced

5.11.0

Fixed

5.15.212

Type: ECOSYSTEM
Events: Introduced

5.16.0

Fixed

6.1.178

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.145

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.96

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.39

Type: ECOSYSTEM
Events: Introduced

6.17.0

Fixed

7.1.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64360.json"