Description

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Add a sanity check for btree node size Syzbot reported an uninit-value bug in [1] with a corrupted HFS+ image, during the file system mounting process, specifically while loading the catalog, a corrupted node_size value of 1 caused the rec_off argument passed to hfs_bnode_read_u16() (within hfs_bnode_find()) to be excessively large. Consequently, the function failed to return a valid value to initialize the off variable, triggering the bug [1]. Every node starts from BTree node descriptor: struct hfs_bnode_desc. So, the size of node cannot be lesser than that. However, technical specification declares that: "The node size (which is expressed in bytes) must be power of two, from 512 through 32,768, inclusive." Add a check for btree node size base on technical specification. [1] BUG: KMSAN: uninit-value in hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584 hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584 hfsplus_btree_open+0x169a/0x1e40 fs/hfsplus/btree.c:382 hfsplus_fill_super+0x111f/0x2770 fs/hfsplus/super.c:553 get_tree_bdev_flags+0x6e6/0x920 fs/super.c:1694 get_tree_bdev+0x38/0x50 fs/super.c:1717 hfsplus_get_tree+0x35/0x40 fs/hfsplus/super.c:709 vfs_get_tree+0xb3/0x5d0 fs/super.c:1754 fc_mount fs/namespace.c:1193 [inline]

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-28T08:16:50.700Z",
  "pubdate": "2026-08-28T08:16:50.700Z",
  "executiveSummary": "The Linux kernel HFS+ filesystem implementation contains an input validation vulnerability originating from insufficient sanity checking of B-Tree node sizes.\nThis vulnerability is classified as an uninitialized value issue, which can be triggered by providing a corrupted HFS+ filesystem image.\nThe defect primarily impacts the kernel memory safety during the filesystem mounting process, specifically when the kernel attempts to load and parse the catalog file.\nAn attacker with the ability to provide a malicious filesystem image can exploit this flaw to cause the kernel to access uninitialized memory regions.\nThis can result in a kernel panic, leading to a local denial-of-service (DoS) condition.\nWhile the vulnerability is triggered during the mount phase, it requires the kernel to process a crafted HFS+ image, making the exploitation dependent on the mounting of untrusted or corrupted storage media.\nThe risk is primarily localized to systems that allow mounting HFS+ filesystems from potentially adversarial sources.",
  "technicalDetails": "The vulnerability resides within the HFS+ B-Tree parsing logic of the Linux kernel, specifically impacting the interaction between hfsplus_btree_open() and hfs_bnode_find().\nThe root cause is the lack of strict validation for the 'node_size' field provided in the B-Tree header of an HFS+ filesystem. The technical specification for HFS+ dictates that node sizes must be a power of two, ranging from 512 to 32,768 bytes. The kernel failed to enforce these constraints, allowing arbitrarily small or invalid values (e.g., 1) to be processed.\nWhen a corrupted HFS+ image sets the 'node_size' to an invalidly low value, the subsequent call to hfs_bnode_read_u16() (invoked by hfs_bnode_find()) receives an erroneous offset argument. This offset, being excessively large relative to the malformed node size, prevents the function from successfully reading the necessary data into the 'off' variable.\nBecause the 'off' variable remains uninitialized when the logic fails to return a valid value, the kernel proceeds to use this uninitialized stack memory in subsequent operations within hfsplus_bnode_find().\nThe attack flow follows this sequence: 1) The user initiates a mount operation on a crafted HFS+ filesystem; 2) The kernel calls hfsplus_fill_super(), triggering the initialization of the B-Tree structure via hfsplus_btree_open(); 3) The parser reads the corrupted 'node_size' from the disk image header; 4) The kernel attempts to locate a record in the B-Tree using an invalid offset; 5) The function hfs_bnode_read_u16() fails to populate the destination variable due to the invalid bounds; 6) The kernel consumes the uninitialized memory, leading to a KMSAN (Kernel Memory Sanitizer) report of an 'uninit-value' bug and an immediate system crash or instability.\nThis vulnerability demonstrates a lack of boundary enforcement on metadata structures parsed directly from untrusted filesystem images. By bypassing basic sanity checks, the kernel's memory management state is compromised during the early stages of filesystem metadata parsing, leading to undefined behavior and potential exploitation of kernel stack memory."
}