Look up another CVE · open CVE-2026-80656 in the interactive tracker
CVE-2026-80656
hfsplus: Add a sanity check for btree node size
Published 2026-08-28 (2 months ago) by the Linux kernel CNA. Subsystem fs/hfsplus. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-80656 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Syzbot reported an uninit-value bug in [1] with a corrupted HFS+ image, during the file system mounting process, specifically while loading the catalog, a corrupted node_size value of 1 caused the rec_off argument passed to hfs_bnode_read_u16() (within hfs_bnode_find()) to be excessively large. Consequently, the function failed to return a valid value to initialize the off variable, triggering the bug [1]. Every node starts from BTree node descriptor: struct hfs_bnode_desc. So, the size of node cannot be lesser than that. However, technical specification declares that: "The node size (which is expressed in bytes) must be power of two, from 512 through 32,768, inclusive." Add a check for btree node size base on technical specification. [1] BUG: KMSAN: uninit-value in hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584 hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584 hfsplus_btree_open+0x169a/0x1e40 fs/hfsplus/btree.c:382 hfsplus_fill_super+0x111f/0x2770 fs/hfsplus/super.c:553 get_tree_bdev_flags+0x6e6/0x920 fs/super.c:1694 get_tree_bdev+0x38/0x50 fs/super.c:1717 hfsplus_get_tree+0x35/0x40 fs/hfsplus/super.c:709 vfs_get_tree+0xb3/0x5d0 fs/super.c:1754 fc_mount fs/namespace.c:1193 [inline]
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/hfsplus/btree.c
include/linux/hfs_common.h
- What this is
- HFSPLUS FILESYSTEMMAINTAINERS section matched on fs/hfsplus/ · linux-fsdevel@vger.kernel.org · Maintained
- Kernel module
- hfsplus
Check it on the machine
grep -w CONFIG_HFSPLUS_FS /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w hfsplusPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookworm, trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_HFSPLUS_FS
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-28 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- fs/hfsplus
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 7.1 | 7.1.5 | 306265eb9384 |
| 7.1 | 7.2 | 3f95e2661574 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable hfs_btree_open→hfs_bnode_find path is reached only via local mount(2)/vfs_get_tree on a block/loop/USB device (hfsplus_fill_super); there is no network-facing consumer of hfsplus btree parsing.
- AC:LAttack complexity, low
- A crafted on-disk btree header node_size of 1 is a valid power-of-two and deterministically makes rec_off negative (wrapped to a huge u32), so hfs_bnode_read_u16 skips filling its stack buffer and KMSAN reports uninit-value at mount without races or external preconditions.
- PR:LPrivileges required, low
- hfsplus is FS_REQUIRES_DEV without FS_USERNS_MOUNT; the highest-impact scenario is an unprivileged local user supplying an HFS+ USB/SD image that udisks2 or a desktop automounter mounts, or a loop image attached through session polkit helpers—no real root in init_ns is needed by the attacker.
- UI:NUser interaction, none
- The attacker inserts removable media or supplies the image that gets mounted; mount-time catalog/extent btree loading fires automatically during fill_super with no separate victim action beyond routine automount behavior.
- S:UScope, unchanged
- Uninitialized-value consumption and any mount-time parser fault stay within the host kernel parsing the attacker's filesystem; no VM escape, IOMMU bypass, or sandbox boundary is crossed.
- C:HConfidentiality impact, high
- Before the fix, invalid node_size lets hfs_bnode_read return without initializing the hfs_bnode_read_u16 buffer; the resulting garbage off value drives subsequent btree record-offset parsing and bounded node reads that consume uninitialized stack bytes—a memory-safety defect class treated as arbitrary read potential per kernel CVSS guidance.
- I:HIntegrity impact, high
- Attacker-controlled sub-512 power-of-two node_size corrupts btree rec_off arithmetic; uninitialized or crafted record offsets can pass hfs_bnode_find checks and seed inconsistent in-memory btree nodes whose corrupted offsets propagate into further mount-time bmap and page-cache accesses.
- A:HAvailability impact, high
- Syzbot/KMSAN builds panic on the uninit-value at hfsplus_bnode_find; even on production kernels a crafted image causes mount failure after kernel error logging, and repeated automount of malicious removable media can deny access to the volume and waste mount resources.