CVE-2026-46169 hfsplus: fix uninit-value by validating catalog record size
A local attacker with mount privileges can trigger an uninitialized memory read in the HFS+ filesystem driver, potentially leaking kernel memory contents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46169?
CVE-2026-46169 is a medium-severity vulnerability in Linux kernel, published on 28 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
hfsplus: fix uninit-value by validating catalog record size
Syzbot reported a KMSAN uninit-value issue in hfsplus_strcasecmp(). The root cause is that hfs_brec_read() doesn't validate that the on-disk record size matches the expected size for the record type being read.
When mounting a corrupted filesystem, hfs_brec_read() may read less data than expected. For example, when reading a catalog thread record, the debug output showed:
HFSPLUS_BREC_READ: rec_len=520, fd->entrylength=26 HFSPLUS_BREC_READ: WARNING - entrylength (26) < rec_len (520) - PARTIAL READ!
hfs_brec_read() only validates that entrylength is not greater than the buffer size, but doesn't check if it's less than expected. It successfully reads 26 bytes into a 520-byte structure and returns success, leaving 494 bytes uninitialized.
This uninitialized data in tmp.thread.nodeName then gets copied by hfsplus_cat_build_key_uni() and used by hfsplus_strcasecmp(), triggering the KMSAN warning when the uninitialized bytes are used as array indices in case_fold().
Fix by introducing hfsplus_brec_read_cat() wrapper that: 1. Calls hfs_brec_read() to read the data 2. Validates the record size based on the type field: - Fixed size for folder and file records - Variable size for thread records (depends on string length) 3. Returns -EIO if size doesn't match expected
For thread records, check against HFSPLUS_MIN_THREAD_SZ before reading nodeName.length to avoid reading uninitialized data at call sites that don't zero-initialize the entry structure.
Also initialize the tmp variable in hfsplus_find_cat() as defensive programming to ensure no uninitialized data even if validation is bypassed.
Weakness: CWE-908
Which versions are affected by CVE-2026-46169?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46169?
Apply the vendor's patch.
Is CVE-2026-46169 being exploited?
There is no known exploitation of CVE-2026-46169 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-46169, DEBIAN-CVE-2026-46169, GHSA-wjh6-3xg7-c2h2, ROOT-OS-DEBIAN-11-CVE-2026-46169, ROOT-OS-DEBIAN-12-CVE-2026-46169, ROOT-OS-UBUNTU-2204-CVE-2026-46169 and 2 more.