# CVE-2026-80656: linux: In the Linux kernel, the following vulnerability has been resolved:  hfsplus: Add a sanity check for btree node size...

CVE-2026-80656 is fixed in linux on 1 platform by DEBIAN-CVE-2026-80656 (version 7.1.5-1), released August 29, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-80656
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 28, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  hfsplus: Add a sanity check for btree node size  Syzbot reported an uninit-value bug in [1] with a corrupted HFS+ image, during the file system mounting process, specifically while loading the catalog, a corrupted node_size value of 1 caused the rec_off argument passed to hfs_bnode_read_u16() (within hfs_bnode_find()) to be excessively large. Consequently, the function failed to return a valid value to initialize the off variable, triggering the bug [1].  Every node starts from BTree node descriptor: struct hfs_bnode_desc. So, the size of node cannot be lesser than that. However, technical specification declares that: "The node size (which is expressed in bytes) must be power of two, from 512 through 32,768, inclusive." Add a check for btree node size base on technical specification.  [1] BUG: KMSAN: uninit-value in hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584  hfsplus_bnode_find+0x141c/0x1600 fs/hfsplus/bnode.c:584  hfsplus_btree_open+0x169a/0x1e40 fs/hfsplus/btree.c:382  hfsplus_fill_super+0x111f/0x2770 fs/hfsplus/super.c:553  get_tree_bdev_flags+0x6e6/0x920 fs/super.c:1694  get_tree_bdev+0x38/0x50 fs/super.c:1717  hfsplus_get_tree+0x35/0x40 fs/hfsplus/super.c:709  vfs_get_tree+0xb3/0x5d0 fs/super.c:1754  fc_mount fs/namespace.c:1193 [inline]

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.1.5-1 | [DEBIAN-CVE-2026-80656](https://patchblox.com/security/data/fix/linux/debian-cve-2026-80656.md) | Aug 29, 2026 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.