CVE-2026-64360: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64360 Overview

CVE-2026-64360 is an uninitialized memory use vulnerability in the Linux kernel's HFS and HFS+ filesystem drivers. The flaw resides in the hfs_bnode_read() function, which can return early without writing to the caller's output buffer. Two conditions trigger this behavior: failure of is_bnode_offset_valid() or when check_and_correct_requested_length() corrects the requested length to zero. Callers such as hfs_bnode_read_u16() and hfs_bnode_read_u8() pass stack-allocated buffers and consume the result unconditionally, producing KMSAN uninit-value reports. The upstream fix zero-initializes the buffer at the start of hfs_bnode_read() before any validation runs, ensuring deterministic behavior across every early-return path in both hfs and hfsplus.

Critical Impact
A local attacker able to mount a crafted HFS or HFS+ image can trigger reads of uninitialized kernel stack memory, potentially exposing kernel data or contributing to further exploitation primitives.

Affected Products

Linux kernel hfs filesystem driver
Linux kernel hfsplus filesystem driver
Distributions shipping affected upstream kernel versions prior to the referenced stable commits

Discovery Timeline

2026-07-25 - CVE-2026-64360 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64360

Vulnerability Analysis

The defect sits in hfs_bnode_read(), a helper used to read bytes from an HFS/HFS+ B-tree node into a caller-supplied buffer. Two validation paths inside the function can cause it to return before any write occurs. The first is is_bnode_offset_valid(), which rejects offsets outside the node bounds. The second is check_and_correct_requested_length(), which may reduce a requested read length to zero when the requested range would exceed valid boundaries.

Callers including hfs_bnode_read_u16() and hfs_bnode_read_u8() allocate small buffers on the stack and pass them to hfs_bnode_read(). These callers do not check a return status and instead consume the buffer contents directly. When the function returns early, the stack buffer retains whatever residual data was previously on the kernel stack. KMSAN (Kernel Memory Sanitizer) instrumentation flagged this pattern as a legitimate uninit-value use.

Root Cause

The root cause is a contract mismatch between hfs_bnode_read() and its callers. The function may return without touching the output buffer, but callers assume the buffer is always populated. The corrective patch normalizes the contract by zero-initializing the destination buffer at the entry of hfs_bnode_read(), before any validation. This centralizes the guarantee rather than requiring each of many call sites in hfs and hfsplus to initialize local buffers correctly.

Attack Vector

Exploitation requires local access to mount or otherwise cause the kernel to parse a crafted HFS or HFS+ filesystem image. An attacker producing a malformed B-tree node with offsets or lengths that trigger the early-return paths can force the caller to consume uninitialized stack memory. The impact depends on what previously occupied that stack region and how the consumed value is used downstream. See the upstream commits referenced below for exact patch content.

Refer to the upstream commits for the exact fix: Kernel Git Commit 0b189b2, Kernel Git Commit 16ca053, Kernel Git Commit 34684a0, Kernel Git Commit 8f72fd2, Kernel Git Commit d2afc7e, Kernel Git Commit d5b45ba, Kernel Git Commit d67aade, and Kernel Git Commit f3461b8.

Detection Methods for CVE-2026-64360

Indicators of Compromise

Mount attempts against HFS or HFS+ images from untrusted sources, particularly removable media or user-supplied disk images.
KMSAN or KASAN kernel log entries referencing hfs_bnode_read, hfs_bnode_read_u16, or hfs_bnode_read_u8.
Unexpected kernel warnings or oops events originating from the hfs or hfsplus modules.

Detection Strategies

Audit installed kernel package versions against distribution security advisories referencing CVE-2026-64360.
Enable kernel module load auditing to identify systems where hfs or hfsplus are loaded but not required.
Correlate filesystem mount events with the source of the mounted image, prioritizing user-initiated mounts of legacy HFS volumes.

Monitoring Recommendations

Forward kernel logs (dmesg, journald) to a centralized log platform and alert on stack traces containing hfs_bnode_read.
Monitor mount syscalls for HFS/HFS+ filesystem types using auditd or eBPF-based telemetry.
Track kernel package inventory across the fleet to confirm patch coverage.

How to Mitigate CVE-2026-64360

Immediate Actions Required

Apply the vendor kernel update once your distribution publishes a build containing the referenced upstream commits.
Unload the hfs and hfsplus modules on systems that do not require legacy Apple filesystem support.
Restrict mount privileges so that unprivileged users cannot mount arbitrary filesystem images.

Patch Information

The fix zero-initializes the output buffer at the start of hfs_bnode_read() before any validation, guaranteeing deterministic content on every early-return path. Backports are available across stable branches via the referenced commits: 0b189b2, 16ca053, 34684a0, 8f72fd2, d2afc7e, d5b45ba, d67aade, and f3461b8. Verify your distribution kernel changelog lists one of these commits before considering the system remediated.

Workarounds

Blacklist the hfs and hfsplus modules using /etc/modprobe.d/ configuration where these filesystems are not required.
Prevent automatic mounting of HFS/HFS+ media by disabling desktop automount policies for these filesystem types.
Enforce administrative approval for mounting removable media containing legacy Apple filesystems.

bash

# Blacklist HFS/HFS+ kernel modules
echo 'blacklist hfs'     | sudo tee /etc/modprobe.d/blacklist-hfs.conf
echo 'blacklist hfsplus' | sudo tee -a /etc/modprobe.d/blacklist-hfs.conf

# Unload if currently loaded
sudo modprobe -r hfsplus hfs

# Verify modules are no longer loaded
lsmod | grep -E '^hfs(plus)?'