Use of Uninitialized Variable in Linux kernel - CVE-2026-64360
Published: July 27, 2026
Vulnerability identifier: #VU139610
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64360
CWE-ID: CWE-457
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to use of uninitialized memory in hfs_bnode_read() in the hfs and hfsplus bnode handling code when reading bnode data with an invalid offset or a corrected zero length. A local user can trigger an early return and cause callers to use uninitialized stack data to disclose sensitive information.
Affected software
Linux kernel
How to mitigate CVE-2026-64360
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/0b189b2204f1a2612dc68f8d139fb5b80539e710
- https://git.kernel.org/stable/c/16ca053c2be5f4f3044dccf7fc19237dc820d394
- https://git.kernel.org/stable/c/34684a04777358b2b40ac729e54c8e45359e46b3
- https://git.kernel.org/stable/c/8f72fd25a57a457866350359ddd27a43caa62c95
- https://git.kernel.org/stable/c/d2afc7ecee476f9251dd87444f7fb6a424410922
- https://git.kernel.org/stable/c/d5b45bad75cd2730b8452aed4d3b20a2b2a12576
- https://git.kernel.org/stable/c/d67aadee19ffdf3cc8520c5a4f4d5b2916d30baf
- https://git.kernel.org/stable/c/f3461b84a4865d9b5e70fbb71da72ae044a3bcd2