< Back

CVE-2026-64360

Updated on 25 Jul 2026

Severity

5.5 Medium severity

Details

CVSS score
5.5
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

hfs/hfsplus: zero-initialize buffer in hfs_bnode_read

hfs_bnode_read() can return early without writing to the output buffer when is_bnode_offset_valid() fails or when check_and_correct_requested_ length() corrects the length to zero. Callers such as hfs_bnode_read_ u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the result unconditionally, leading to KMSAN uninit-value reports.

Rather than initializing at each individual call site, zero the buffer at the start of hfs_bnode_read() before any validation checks. This ensures all callers in both hfs and hfsplus get a deterministic zero value regardless of which early-return path is taken.

Details

Affected product:
Debian 11 ELS , Ubuntu 20.04 ELS
Affected packages:
linux @ 5.10.259 (+1 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Debian 11 Released
9 kernels
  • 5.10.244-1
  • 5.10.247-1
  • 5.10.249-1
  • 5.10.251-1
  • 5.10.251-3
  • 5.10.251-4
  • 5.10.251-5
  • 5.10.257-1
  • 5.10.259-1
Debian 11 cloud Released
9 kernels
  • 5.10.244-1
  • 5.10.247-1
  • 5.10.249-1
  • 5.10.251-1
  • 5.10.251-3
  • 5.10.251-4
  • 5.10.251-5
  • 5.10.257-1
  • 5.10.259-1
Debian 12 Released
42 kernels
  • 6.1.38-1
  • 6.1.38-2
  • 6.1.38-4
  • 6.1.52-1
  • 6.1.55-1
  • 6.1.64-1
  • 6.1.66-1
  • 6.1.69-1
  • 6.1.76-1
  • 6.1.27-1
  • 6.1.67-1
  • 6.1.85-1
  • 6.1.90-1
  • 6.1.94-1
  • 6.1.99-1
  • 6.1.106-3
  • 6.1.112-1
  • 6.1.115-1
  • 6.1.119-1
  • 6.1.123-1
  • 6.1.128-1
  • 6.1.124-1
  • 6.1.129-1
  • 6.1.133-1
  • 6.1.135-1
  • 6.1.137-1
  • 6.1.140-1
  • 6.1.139-1
  • 6.1.147-1
  • 6.1.148-1
  • 6.1.153-1
  • 6.1.158-1
  • 6.1.159-1
  • 6.1.162-1
  • 6.1.164-1
  • 6.1.170-1
  • 6.1.170-3
  • 6.1.172-1
  • 6.1.174-1
  • 6.1.170-2
  • 6.1.176-1
  • 6.1.177-1
Ubuntu 22.04 Planned —
Ubuntu 22.04 AWS Planned —
Ubuntu 22.04 Azure Planned —
Ubuntu 24.04 Planned —
Ubuntu 24.04 AWS Planned —
Ubuntu 26.04 Planned —