CVE-2026-80656 Overview
CVE-2026-80656 is an uninitialized memory use vulnerability in the Linux kernel's hfsplus filesystem driver. The flaw occurs during HFS+ filesystem mounting when the kernel loads the catalog B-tree. A corrupted node_size value of 1 causes the rec_off argument passed to hfs_bnode_read_u16() inside hfs_bnode_find() to become excessively large. This condition leaves the off variable uninitialized, which Syzbot flagged with a KMSAN uninit-value report. A local attacker who can mount a crafted HFS+ image can trigger kernel memory disclosure or corruption.
Critical Impact
Local attackers mounting a malicious HFS+ image can trigger uninitialized memory use in the kernel, leading to information disclosure, denial of service, or potential privilege escalation on affected systems.
Affected Products
- Linux kernel hfsplus filesystem driver (upstream)
- Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
- Systems that automatically mount removable HFS+ media
Discovery Timeline
- 2026-08-28 - CVE-2026-80656 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80656
Vulnerability Analysis
The vulnerability resides in fs/hfsplus/bnode.c at hfsplus_bnode_find(), invoked from hfsplus_btree_open() during hfsplus_fill_super(). HFS+ B-tree nodes begin with a struct hfs_bnode_desc descriptor, so the node size must be at least the size of that descriptor. The HFS+ technical specification also requires the node size to be a power of two between 512 and 32,768 bytes inclusive. The driver did not validate this field when parsing on-disk metadata. A crafted image supplying node_size = 1 propagates through B-tree lookup arithmetic and causes hfs_bnode_read_u16() to return without setting its output, leaving off uninitialized [CWE-908].
Root Cause
The root cause is missing input validation on filesystem metadata read from an untrusted image. Because the node_size field is not sanity checked against the specification's bounds, downstream offset calculations produce out-of-range values. Subsequent reads short-circuit without initializing local variables, and the kernel later consumes the uninitialized data.
Attack Vector
Exploitation requires local access and the ability to mount a filesystem image, either through physical insertion of removable media, user-triggered automount, or a privileged mount operation on attacker-controlled data. The attacker crafts an HFS+ image with a malformed B-tree header where node_size is set below the minimum permitted value. When the kernel mounts the image and opens the catalog B-tree, it processes the corrupted descriptor and reaches the vulnerable code path.
See the upstream fixes at kernel.org commit 306265eb and kernel.org commit 3f95e266 for the sanity check implementation.
Detection Methods for CVE-2026-80656
Indicators of Compromise
- Kernel log entries containing KMSAN: uninit-value in hfsplus_bnode_find or oops traces referencing hfsplus_btree_open and hfsplus_fill_super.
- Unexpected mount attempts of HFS+ volumes from removable devices or user-owned image files on production systems.
- System crashes or hangs coinciding with insertion of external media containing HFS+ filesystems.
Detection Strategies
- Audit mount syscalls and mount(8) invocations filtering for the hfsplus filesystem type using auditd rules on sys_mount.
- Monitor loading of the hfsplus kernel module via modprobe and finit_module events, especially on hosts that do not require HFS+ support.
- Correlate kernel ring buffer messages from dmesg and journalctl -k with process-execution telemetry to identify user-triggered mounts of untrusted images.
Monitoring Recommendations
- Alert on any non-administrative user invoking mount with an HFS+ image path or loop device.
- Track USB and removable media insertion events and cross-reference with filesystem identification tools such as blkid.
- Forward kernel oops and KMSAN reports to a centralized logging platform for retention and correlation with endpoint telemetry.
How to Mitigate CVE-2026-80656
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in commits 306265eb and 3f95e266, or install the distribution kernel update that incorporates them.
- Blacklist the hfsplus kernel module on systems that do not require HFS+ support using install hfsplus /bin/true in /etc/modprobe.d/.
- Restrict mount privileges so unprivileged users cannot mount arbitrary filesystem images, and disable automatic mounting of removable media on servers.
Patch Information
The fix adds a sanity check enforcing that the B-tree node_size is a power of two between 512 and 32,768 bytes, matching the HFS+ specification. The patches are available at kernel.org commit 306265eb and kernel.org commit 3f95e266. Rebuild and reboot into the patched kernel to apply the fix.
Workarounds
- Prevent loading of the hfsplus module by adding it to a modprobe blacklist and running rmmod hfsplus if already loaded.
- Disable automount services such as udisks2 or GNOME auto-mounting on systems that handle untrusted removable media.
- Enforce policy that only administrators may mount filesystem images, and validate images with fsck.hfsplus on isolated hosts before use.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
