CVE-2026-64360

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hfs/hfsplus: zero-initialize buffer in hfs_bnode_read<br /> <br /> hfs_bnode_read() can return early without writing to the output buffer<br /> when is_bnode_offset_valid() fails or when check_and_correct_requested_<br /> length() corrects the length to zero. Callers such as hfs_bnode_read_<br /> u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the<br /> result unconditionally, leading to KMSAN uninit-value reports.<br /> <br /> Rather than initializing at each individual call site, zero the buffer<br /> at the start of hfs_bnode_read() before any validation checks. This<br /> ensures all callers in both hfs and hfsplus get a deterministic zero<br /> value regardless of which early-return path is taken.