CVE-2026-80656

The Linux kernel's HFS+ file system driver does not validate the B-tree node size stored in a volume's metadata before using it, although the HFS+ specification requires this value to be a power of two between 512 and 32,768 bytes. When a corrupted or maliciously crafted HFS+ image with an invalid node size (for example, a value of 1) is mounted, hfsplus_bnode_read_u16() is reached with an excessively large offset while loading the catalog, causing the kernel to consume uninitialized memory (reported by syzbot as a KMSAN uninit-value bug). An attacker with local access who can cause an untrusted HFS+ volume or disk image to be mounted can trigger the condition; the CVSS 3.1 score of 7.8 (local vector, low privileges, no user interaction, high confidentiality/integrity/availability impact) indicates kernel memory-disclosure or corruption risk that could support privilege escalation. Any Linux system whose kernel includes hfsplus support and that mounts untrusted media — USB drives, SD cards, Mac-formatted disks or disk images — is affected. No public proof-of-concept is known, the CVE is not in CISA KEV, and EPSS estimates only ~0.1% exploitation probability over the next 30 days, so there is no evidence of exploitation in the wild.

What to do: Apply a kernel update from your distribution that includes the hfsplus b-tree node-size sanity check (backported stable patch or fixed mainline release); the disclosure does not name a fixed version, so confirm with your vendor. Until patched, avoid mounting untrusted HFS+ volumes or disk images, restrict unprivileged mounting, or blacklist/unload the hfsplus module if the filesystem is not needed. To check exposure, run lsmod | grep hfsplus or verify CONFIG_HFSPLUS_FS in the kernel configuration.