CVE-2026-64361: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64361 Overview

CVE-2026-64361 is an integer overflow vulnerability in the Linux kernel's HFS and HFS+ filesystem code. The flaw resides in the check_and_correct_requested_length() function, which performs bounds validation using 32-bit unsigned arithmetic. When a caller supplies a large len value, the addition off + len wraps past 2^32 and produces a small result that passes the bounds check incorrectly. A subsequent memmove then reads roughly 4GB past the node buffer, resulting in out-of-bounds memory access.

Critical Impact
A local attacker able to mount or interact with a crafted HFS/HFS+ filesystem image can trigger kernel out-of-bounds memory access, leading to memory corruption, information disclosure, or denial of service.

Affected Products

Linux kernel — HFS filesystem driver (fs/hfs)
Linux kernel — HFS+ filesystem driver (fs/hfsplus)
Distributions shipping vulnerable kernel versions with HFS/HFS+ support enabled

Discovery Timeline

2026-07-25 - CVE-2026-64361 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64361

Vulnerability Analysis

The vulnerability is an integer overflow [CWE-190] in the check_and_correct_requested_length() helper used by the HFS and HFS+ B-tree record code. The function validates that a requested (off + len) range fits within node_size before performing memory operations on the node buffer. Both off and len are 32-bit unsigned integers, and the addition is performed in u32 before comparison.

When hfs_brec_remove() passes a len value derived from data_off - keyoffset - size, an underflowed subtraction can produce values near 0xFFFFFFFF. With off=14 and len=0xFFFFFFF2, the sum wraps to 6, which is smaller than a typical node_size of 512. The bounds check succeeds, and the subsequent memmove operates on approximately 4GB of memory beyond the node buffer.

Root Cause

The root cause is missing width promotion during arithmetic bounds validation. The comparison (off + len) > node_size is evaluated in 32-bit unsigned arithmetic, which silently wraps on overflow. The fix widens the addition to u64 before comparing against node_size, preventing the wrap while preserving the original logic. An underflow in the calling function (hfs_brec_remove()) supplies the malformed length that triggers the condition.

Attack Vector

Exploitation requires local access with the ability to mount or interact with a crafted HFS or HFS+ filesystem image. An attacker prepares a filesystem image whose B-tree metadata drives hfs_brec_remove() into the underflow path, then triggers a record removal. The resulting kernel out-of-bounds memmove can corrupt adjacent memory, leak kernel data, or panic the system. The vulnerability requires low privileges but is exploitable only from a local context.

See the upstream fix commits for technical detail: Kernel Git Commit 607217f7, Kernel Git Commit c25d3c93, and Kernel Git Commit fc9d1447.

Detection Methods for CVE-2026-64361

Indicators of Compromise

Kernel oops or panic messages referencing check_and_correct_requested_length, hfs_brec_remove, or memmove in the HFS/HFS+ code paths.
Unexpected mount operations for HFS or HFS+ filesystems on systems that do not normally handle Apple filesystem images.
KASAN or slab corruption warnings triggered during operations on HFS/HFS+ volumes.

Detection Strategies

Audit kernel logs (dmesg, journalctl -k) for stack traces originating in fs/hfs or fs/hfsplus modules.
Monitor for mount syscalls specifying hfs or hfsplus filesystem types from non-administrative or unexpected user contexts.
Track loading of the hfs and hfsplus kernel modules on servers where these filesystems are not required.

Monitoring Recommendations

Enable auditd rules for mount and finit_module syscalls to capture attempts to mount HFS/HFS+ images.
Forward kernel logs to a centralized logging system for correlation of crash signatures across the fleet.
Alert on repeated kernel warnings tied to filesystem drivers, which may indicate exploitation attempts or fuzzing activity.

How to Mitigate CVE-2026-64361

Immediate Actions Required

Apply the upstream kernel patches referenced by the stable commit IDs and rebuild or install a fixed kernel package from your distribution.
If HFS and HFS+ are not required, blacklist the hfs and hfsplus kernel modules to eliminate the attack surface entirely.
Restrict the ability of unprivileged users to mount arbitrary filesystem images, including loop-mounted files and removable media.

Patch Information

The fix widens the (off + len) addition to u64 before comparing against node_size in check_and_correct_requested_length(). Patched commits available on kernel.org include 607217f7, 671c3fcc, 7399c3ba, 966cb76f, b6a48164, c25d3c93, c8dd1121, and fc9d1447. Consult your distribution's security tracker for the corresponding backported package versions.

Workarounds

Prevent automatic mounting of removable media containing HFS/HFS+ volumes by disabling relevant udisks/udev rules.
Blacklist the affected modules via /etc/modprobe.d/ until a patched kernel is deployed.
Enforce least privilege on desktop and multi-user systems to prevent untrusted users from supplying filesystem images.

bash

# Blacklist HFS and HFS+ kernel modules
echo 'blacklist hfs'     | sudo tee /etc/modprobe.d/blacklist-hfs.conf
echo 'blacklist hfsplus' | sudo tee -a /etc/modprobe.d/blacklist-hfs.conf

# Prevent on-demand loading
echo 'install hfs /bin/true'     | sudo tee -a /etc/modprobe.d/blacklist-hfs.conf
echo 'install hfsplus /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-hfs.conf

# Rebuild initramfs and reboot
sudo update-initramfs -u
sudo reboot