In the Linux kernel, the following vulnerability has been resolved:
hfs/hfsplus: fix u32 overflow in checkandcorrectrequestedlength
checkandcorrectrequestedlength() compares (off + len) against nodesize using u32 arithmetic. When the caller passes a large len value (e.g. from an underflowed subtraction in hfsbrec_remove()), off + len can wrap past 2^32 and produce a small result, causing the bounds check to pass when it should fail.
For example, with off=14 and len=0xFFFFFFF2 (underflowed from dataoff - keyoffset - size in hfsbrecremove), off + len wraps to 6, which is less than a typical nodesize of 512, so the check passes and the subsequent memmove reads ~4GB past the node buffer.
Fix this by widening the addition to u64 before comparing against node_size. This prevents the u32 wrap while keeping the logic straightforward.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64361.json"
}