{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2026-46169", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-46169", "idYear": 2026, "status": "PUBLISHED", "publishedAt": "2026-05-28T09:36:24.361Z", "updatedAt": "2026-06-19T11:59:47.129Z", "importedAt": "2026-10-24T01:58:14.884Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "hfsplus: fix uninit-value by validating catalog record size", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix uninit-value by validating catalog record size\n\nSyzbot reported a KMSAN uninit-value issue in hfsplus_strcasecmp(). The\nroot cause is that hfs_brec_read() doesn't validate that the on-disk\nrecord size matches the expected size for the record type being read.\n\nWhen mounting a corrupted filesystem, hfs_brec_read() may read less data\nthan expected. For example, when reading a catalog thread record, the\ndebug output showed:\n\n HFSPLUS_BREC_READ: rec_len=520, fd->entrylength=26\n HFSPLUS_BREC_READ: WARNING - entrylength (26) < rec_len (520) - PARTIAL READ!\n\nhfs_brec_read() only validates that entrylength is not greater than the\nbuffer size, but doesn't check if it's less than expected. It successfully\nreads 26 bytes into a 520-byte structure and returns success, leaving 494\nbytes uninitialized.\n\nThis uninitialized data in tmp.thread.nodeName then gets copied by\nhfsplus_cat_build_key_uni() and used by hfsplus_strcasecmp(), triggering\nthe KMSAN warning when the uninitialized bytes are used as array indices\nin case_fold().\n\nFix by introducing hfsplus_brec_read_cat() wrapper that:\n1. Calls hfs_brec_read() to read the data\n2. Validates the record size based on the type field:\n - Fixed size for folder and file records\n - Variable size for thread records (depends on string length)\n3. Returns -EIO if size doesn't match expected\n\nFor thread records, check against HFSPLUS_MIN_THREAD_SZ before reading\nnodeName.length to avoid reading uninitialized data at call sites that\ndon't zero-initialize the entry structure.\n\nAlso initialize the tmp variable in hfsplus_find_cat() as defensive\nprogramming to ensure no uninitialized data even if validation is\nbypassed.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "status": "affected", "versionType": "git", "lessThan": "3003dbf62d151d47a6b90f71655292a51a05f244" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "status": "affected", "versionType": "git", "lessThan": "8be69532e399eec9d9d990f6958b4ff2383b19b3" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "status": "affected", "versionType": "git", "lessThan": "3bc337697c66db2e2a4a94f0509c282c1a014b86" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "status": "affected", "versionType": "git", "lessThan": "61a790974ff7e533acbceca06c7d02f22bf96d4d" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "status": "affected", "versionType": "git", "lessThan": "c91bbd6193c70a02c50c22e0fb1f60c3c5bd053a" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "status": "affected", "versionType": "git", "lessThan": "a420904450962a562ad053a41a53a27755021b48" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "status": "affected", "versionType": "git", "lessThan": "93e8d613f1a01b6637f387cc93f184cf7fb881d6" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "status": "affected", "versionType": "git", "lessThan": "b6b592275aeff184aa82fcf6abccd833fb71b393" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "2.6.12", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "2.6.12" }, { "version": "5.10.259", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.210", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.1.176", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.140", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.88", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.18.30", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.18.*" }, { "version": "7.0.7", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "7.0.*" }, { "version": "7.1", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }