SECUFOCUSNOW
Home›CVE index›CVE-2026-64361
Review reviewHigh

CVE-2026-64361

Linux

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length check_and_correct_requested_length() compares (off + len) against node_size using u32 arithmetic. When the caller passes a large len value (e.g. from an underflowed subtraction in hfs_brec_remove()), off + len can wrap past 2^32 and produce a small result, causing the bounds check to pass when it should fail. For example, with off=14 and len=0xFFFFFFF2 (underflowed from data_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6, which is less tha...

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.25
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length check_and_correct_requested_length() compares (off + len) against node_size using u32 arithmetic. When the caller passes a large len value (e.g. from an underflowed subtraction in hfs_brec_remove()), off + len can wrap past 2^32 and produce a small result, causing the bounds check to pass when it should fail. For example, with off=14 and len=0xFFFFFFF2 (underflowed from data_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6, which is less tha...

Affected product and versions

Product
Linux
Affected versions
>= 67ecc81f6492275c9c54280532f558483c99c90e < c8dd112173c02adf539fe2ad34a45f5e0068780d, >= a1a60e79502279f996e55052f50cc14919020475 < fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1, >= fe2891a9c43ab87d1a210d61e6438ca6936e2f62 < 671c3fcc2ad31c1311ea6414382a2d95104ae1b9, >= 384a66b89f9540a9a8cb0f48807697dfabaece4c < b6a481642ea1977be2f84dc08c5affd742c177e7, >= efc095b35b23297e419c2ab4fc1ed1a8f0781a29 < 7399c3baee7bb622a92f0b895cd4d3009a693f2b, >= a431930c9bac518bf99d6b1da526a7f37ddee8d8 < 607217f7ad419b53926f71e3f75001813bbc08ad, >= a431930c9bac518bf99d6b1da526a7f37ddee8d8 < c25d3c931a63e762fcaa9cb125b901c53b62403f, >= a431930c9bac518bf99d6b1da526a7f37ddee8d8 < 966cb76fb2857a4242cab6ea2ea17acf818a3da7, >= e7d2dc2421e821e4045775e6dc226378328de6f6, >= fc7f732984ec91f30be3e574e0644066d07f2b78, >= eec522fd0d28106b14a59ab2d658605febe4a3bb, >= 5.10.241 < 5.10.261, >= 5.15.190 < 5.15.212, >= 6.1.149 < 6.1.178, >= 6.6.103 < 6.6.145, >= 6.12.43 < 6.12.97, >= 5.4.297 < 5.5, >= 6.15.11 < 6.16, >= 6.16.2 < 6.17, >= 6.17
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available