CVE-2026-64361

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length<br /> <br /> check_and_correct_requested_length() compares (off + len) against<br /> node_size using u32 arithmetic. When the caller passes a large len<br /> value (e.g. from an underflowed subtraction in hfs_brec_remove()),<br /> off + len can wrap past 2^32 and produce a small result, causing the<br /> bounds check to pass when it should fail.<br /> <br /> For example, with off=14 and len=0xFFFFFFF2 (underflowed from<br /> data_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6,<br /> which is less than a typical node_size of 512, so the check passes and<br /> the subsequent memmove reads ~4GB past the node buffer.<br /> <br /> Fix this by widening the addition to u64 before comparing against<br /> node_size. This prevents the u32 wrap while keeping the logic<br /> straightforward.