Linux Kernel HFS+ Btree Node Size Validation Bypass

CVE-2026-80656 is a validation vulnerability in the Linux kernel's HFS+ filesystem implementation that allows a maliciously crafted or corrupted filesystem image to trigger an uninitialized variable bug during mount. When processing the catalog btree during filesystem mounting, a corrupted node_size value (such as 1) causes invalid memory offset calculations in hfs_bnode_read_u16(), leading to out-of-bounds reads and potential information disclosure. This affects any Linux system that attempts to mount an untrusted HFS+ image, including users mounting external drives, container environments processing user-supplied filesystem images, and systems handling archived or downloaded HFS+ formatted media. The high CVSS score of 7.8 reflects the potential for denial of service and information leakage through uninitialized memory exposure.

Casky.ai's Claude-powered analysis would map this vulnerability to Defense Evasion and Privilege Escalation patterns by identifying the missing input validation checkpoint. While MITRE ATT&CK techniques aren't currently mapped to this CVE, practitioners using Casky would see detection patterns aligned with T1564 (Hide Artifacts) and T1036 (Masquerading) tactics—specifically how corrupted filesystem metadata serves as an obfuscation technique to bypass security checks. Casky's extended reasoning would flag the root cause: insufficient sanity checking on filesystem structure parameters before use in memory operations. Security practitioners investigating this would receive alerts highlighting the need for boundary validation on untrusted filesystem input, kernel hardening review procedures, and fuzzing test coverage for filesystem parsing code—actionable insights that map across the 754 security skills Casky tracks to help teams prevent similar validation bypasses in their own codebases.