CVE-2026-46169: Linux Kernel HFS+ Uninit-Value Vulnerability

CVE-2026-46169 Overview

CVE-2026-46169 is a Linux kernel vulnerability in the hfsplus filesystem driver. The flaw resides in hfs_brec_read(), which fails to validate that on-disk catalog record sizes match the expected size for the record type being read. When a corrupted HFS+ filesystem is mounted, the function may read fewer bytes than expected into a larger structure, leaving uninitialized kernel memory in the buffer.

Syzbot discovered the issue through a KMSAN uninit-value report in hfsplus_strcasecmp(). The uninitialized bytes propagate through hfsplus_cat_build_key_uni() and are ultimately used as array indices in case_fold(), producing unpredictable kernel behavior on corrupted or attacker-supplied filesystem images.

Critical Impact
Mounting a maliciously crafted HFS+ image causes the kernel to operate on uninitialized memory, enabling information disclosure or memory corruption in the filesystem layer.

Affected Products

Linux kernel hfsplus filesystem driver
Linux distributions shipping unpatched stable kernels
Systems permitting mount of untrusted HFS+ images or removable media

Discovery Timeline

2026-05-28 - CVE-2026-46169 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46169

Vulnerability Analysis

The vulnerability is an uninitialized memory use ([CWE-908]) in the HFS+ catalog record reading path. hfs_brec_read() validates only that entrylength does not exceed the destination buffer size. It does not verify that the on-disk record is large enough to fully populate the expected structure for its type.

Debug output from the syzbot reproducer illustrates the mismatch: a catalog thread record produced rec_len=520 with fd->entrylength=26. The function copied only 26 bytes into a 520-byte structure and returned success, leaving 494 bytes of the caller's stack or heap buffer uninitialized.

The uninitialized bytes land in tmp.thread.nodeName. That field is subsequently consumed by hfsplus_cat_build_key_uni() and compared in hfsplus_strcasecmp(). The Unicode characters used as case_fold() array indices are therefore attacker-influenced garbage memory, producing the KMSAN warning and unpredictable comparison results.

Root Cause

The root cause is missing record-size validation against the type field in the catalog B-tree. hfs_brec_read() enforces only an upper bound on entrylength, not a type-appropriate lower bound. Folder and file records have fixed expected sizes, while thread records have a variable size depending on nodeName.length, and none of these constraints were checked.

Attack Vector

Exploitation requires the kernel to mount a crafted HFS+ filesystem image. A local attacker with the ability to attach removable media or trigger automounting of an attacker-controlled image can supply catalog records whose declared lengths are shorter than the structures the kernel expects. The resulting uninitialized memory use occurs in kernel context during normal filesystem lookups.

The fix introduces an hfsplus_brec_read_cat() wrapper that validates record size based on the type field, applies fixed expected sizes for folder and file records, and checks thread records against HFSPLUS_MIN_THREAD_SZ before reading nodeName.length. The wrapper returns -EIO when a size mismatch occurs. The tmp variable in hfsplus_find_cat() is also explicitly zero-initialized as defense in depth.

Detection Methods for CVE-2026-46169

Indicators of Compromise

Kernel log messages referencing hfsplus mount failures or -EIO returns from catalog lookups.
KMSAN or KASAN reports citing hfsplus_strcasecmp, hfsplus_cat_build_key_uni, or hfs_brec_read in the call stack.
Unexpected mounting of HFS+ filesystems from removable media or disk images on servers that do not legitimately use HFS+.

Detection Strategies

Audit kernel versions across the Linux fleet and flag hosts running hfsplus modules built before the upstream fix commits referenced in the Linux Kernel Commit Patch.
Monitor for kernel module load events involving hfsplus on systems that do not require Apple filesystem compatibility.
Correlate mount syscall telemetry with the source filesystem type to surface untrusted HFS+ images being attached to production hosts.

Monitoring Recommendations

Enable kernel taint and oops logging forwarding to a centralized log store for retrospective analysis of filesystem-driver crashes.
Track udev and automount events for removable storage to identify unsanctioned HFS+ media insertions.
Alert on repeated hfsplus mount failures from a single user or service account, which can indicate fuzzing or exploitation attempts.

How to Mitigate CVE-2026-46169

Immediate Actions Required

Apply the upstream Linux kernel patches that introduce hfsplus_brec_read_cat() and record-size validation, then reboot affected systems.
Where patching is delayed, blacklist the hfsplus kernel module on hosts that do not require HFS+ support.
Restrict the ability of non-administrative users to mount arbitrary filesystem images, particularly via loop devices or removable media.

Patch Information

The fix is distributed across multiple stable kernel commits. Refer to the Linux Kernel Commit Fix, Linux Kernel Commit Update, Linux Kernel Commit Change, Linux Kernel Commit Patch, and Linux Kernel Commit Modification for backport details. Distribution vendors are publishing updated kernel packages tracking these commits.

Workarounds

Blacklist the module by adding blacklist hfsplus to a file under /etc/modprobe.d/ and rebuilding the initramfs.
Disable automount of removable media in desktop environments and udev rules where HFS+ support is not required.
Enforce policy restricting CAP_SYS_ADMIN and disallow user-namespace mounting of hfsplus on multi-tenant systems.

bash

# Configuration example: prevent hfsplus from loading
echo 'blacklist hfsplus' | sudo tee /etc/modprobe.d/disable-hfsplus.conf
echo 'install hfsplus /bin/true' | sudo tee -a /etc/modprobe.d/disable-hfsplus.conf
sudo update-initramfs -u