CVE-2026-64360

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: zero-initialize buffer in hfs_bnode_read hfs_bnode_read() can return early without writing to the output buffer when is_bnode_offset_valid() fails or when check_and_correct_requested_ length() corrects the length to zero. Callers such as hfs_bnode_read_ u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the result unconditionally, leading to KMSAN uninit-value reports. Rather than initializing at each individual call site, zero the buffer at the start of hfs_bnode_read() before any validation checks. This ensures all callers in both hfs and hfsplus get a deterministic zero value regardless of which early-return path is taken.

• linux linux kernel (>= 5.4.297 < 5.5) • linux linux kernel (>= 5.10.241 < 5.10.261) • linux linux kernel (>= 5.15.190 < 5.15.212) • linux linux kernel (>= 6.1.149 < 6.1.178) • linux linux kernel (>= 6.6.103 < 6.6.145) • linux linux kernel (>= 6.12.43 < 6.12.96) • linux linux kernel (>= 6.15.11 < 6.16) • linux linux kernel (>= 6.16.2 < 6.18.39) • linux linux kernel (>= 6.19 < 7.1.4)