CVE-2026-46169

Technical summary

The vulnerability exists in the HFS+ filesystem mount and catalog lookup code path. Specifically, hfs_brec_read() reads disk records but only validates that the on-disk entrylength does not exceed the buffer size; it does not validate that entrylength meets the minimum expected size for the record type being read. When a corrupted filesystem presents a shortened catalog record (e.g., 26 bytes instead of the expected 520 bytes for a catalog thread record), hfs_brec_read() successfully returns after a partial read, leaving uninitialized kernel memory in the structure. This uninitialized data is subsequently copied by hfsplus_cat_build_key_uni() and passed to hfsplus_strcasecmp(), where it is dereferenced as array indices in case_fold(), triggering KMSAN (Kernel Memory Sanitizer) uninitialized-value warnings. The fix introduces hfsplus_brec_read_cat() as a validation wrapper that checks record size against type-specific expectations before returning to the caller, and initializes the tmp variable in hfsplus_find_cat() as a defensive measure.

Business impact

This vulnerability has limited direct business impact for most deployments. It requires local filesystem access (mounting a crafted HFS+ image) and affects only systems actively using HFS+ (primarily legacy macOS compatibility scenarios). However, in environments where users can mount untrusted filesystems—such as multitenant systems, lab environments, or support scenarios involving user-supplied disk images—a malicious actor could trigger a kernel warning or panic, resulting in temporary service disruption. Information disclosure through uninitialized memory read is also theoretically possible, though constrained by the memory layout and use context.

Affected systems

Any Linux system with the HFS+ filesystem driver compiled and enabled (CONFIG_HFSPLUS). This includes distribution kernels that include HFS+ support for compatibility with Apple devices. Systems that do not use HFS+ (and have the module disabled or not loaded) are not vulnerable. Affected Linux kernel versions prior to the patch release are subject to this issue.

Exploitability

Exploitability is limited to local attackers with the ability to mount filesystems. This requires either direct console access or membership in a group with mount privileges (e.g., wheel, sudoers). The attacker must craft a corrupted HFS+ filesystem image and mount it on the target system. No network vector exists, and no privilege escalation is implied by the vulnerability alone. The condition is triggered reliably if a malformed filesystem is mounted, making it suitable for denial-of-service scenarios but not for remote exploitation.

Remediation

Apply the Linux kernel patch that introduces hfsplus_brec_read_cat() catalog record validation. This patch validates catalog record sizes according to type (fixed sizes for file and folder records, minimum size checks for thread records) and returns -EIO if the on-disk size does not match expectations. Additionally, defensive initialization of the tmp variable in hfsplus_find_cat() prevents uninitialized memory use if validation is somehow bypassed. Verify the specific kernel version in your advisory or release notes for the exact patch version number.

Patch guidance

Monitor your Linux distribution's security advisories for kernel updates that address CVE-2026-46169. The patch is a targeted fix to the HFS+ subsystem and does not require a full kernel rebuild if you use a modular setup. If HFS+ is not in use on your systems, you may disable the module (CONFIG_HFSPLUS=n) to eliminate the attack surface entirely, though patching is still recommended for defense-in-depth. Verify patch application by checking kernel version and reviewing the changelog for the hfsplus_brec_read_cat() function addition.

Detection guidance

Monitor kernel logs for KMSAN warnings related to hfsplus_strcasecmp() or uninitialized-value reports in hfs_brec_read(). Such warnings may indicate an attempt to trigger this vulnerability. On systems with audit enabled, track mount operations involving HFS+ filesystems and cross-reference them with unexpected or untrusted filesystem images. If using intrusion detection, look for patterns of catalog operations on corrupted filesystems. Runtime memory sanitizers (KMSAN) will reliably detect the condition if enabled in your kernel build.

Why prioritize this

Assign this vulnerability to the standard queue rather than critical response. The CVSS 5.5 MEDIUM score reflects local-only attack surface and denial-of-service impact. However, prioritize patching in environments where users regularly mount untrusted filesystems or where HFS+ is actively used for compatibility (e.g., systems handling macOS disk images). Systems with HFS+ disabled or not mounted can be deprioritized but should still receive the patch as part of routine updates.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects: (AV:L) Attack Vector Local—requires local filesystem access or mount privilege; (AC:L) Attack Complexity Low—the condition is triggered reliably by a malformed filesystem; (PR:L) Privileges Required Local user privilege to mount; (UI:N) User Interaction None; (S:U) Scope Unchanged; (C:N) Confidentiality None—no direct data breach, though uninitialized memory could theoretically leak kernel pointers; (I:N) Integrity None—no filesystem or data modification; (A:H) Availability High—kernel warning or panic can disrupt service. The score does not include network attack vector and requires local access, preventing a higher rating.

Frequently asked questions