CVE-2026-64361

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An integer overflow occurs in the check and correct requested length() function within the hfs/hfsplus module. The function uses u32 arithmetic to compare the sum of off and len against node size. If a large len value is provided, such as one resulting from an underflowed subtraction in the hfs brec remove() function, the addition can wrap around 2^32. This results in a small value that bypasses the bounds check, potentially allowing a memmove operation to read approximately 4GB beyond the node buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.