CVE-2022-50581

hfs: fix OOB Read in __hfs_brec_find

State: Published
Severity: 7.8 High
Published: Oct 22, 2025
Updated: Aug 5, 2026
Reserved: Oct 22, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

hfs: fix OOB Read in __hfs_brec_find

Syzbot reported a OOB read bug:

================================================================== BUG: KASAN: slab-out-of-bounds in hfs_strcmp+0x117/0x190 fs/hfs/string.c:84 Read of size 1 at addr ffff88807eb62c4e by task kworker/u4:1/11 CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted 6.1.0-rc6-syzkaller-00308-g644e9524388a #0 Workqueue: writeback wb_workfn (flush-7:0) Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report+0xcd/0x100 mm/kasan/report.c:495 hfs_strcmp+0x117/0x190 fs/hfs/string.c:84 __hfs_brec_find+0x213/0x5c0 fs/hfs/bfind.c:75 hfs_brec_find+0x276/0x520 fs/hfs/bfind.c:138 hfs_write_inode+0x34c/0xb40 fs/hfs/inode.c:462 write_inode fs/fs-writeback.c:1440 [inline]

If the input inode of hfs_write_inode() is incorrect: struct inode struct hfs_inode_info struct hfs_cat_key struct hfs_name u8 len # len is greater than HFS_NAMELEN(31) which is the maximum length of an HFS filename

OOB read occurred: hfs_write_inode() hfs_brec_find() __hfs_brec_find() hfs_cat_keycmp() hfs_strcmp() # OOB read occurred due to len is too large

Fix this by adding a Check on len in hfs_write_inode() before calling hfs_brec_find().

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8c40f2dbae603ef0bd21e87c63f54ec59fd88256Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c886c10a6eddb99923b315f42bf63f448883ef9aAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2344f17c0a89c181ab1a9fef57fd8c3bddfd6e30Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 90103ccb6e60aa4efe48993d23d6a528472f2233Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4fd3a11804c8877ff11fec59c5c53f1635331e3eAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 367296925c7625c3969d2a78d7a3e1dee161beb5Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e9e692917c6e10a7066c7a6d092dcdc3d4e329f3Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before bfc9d8f27f89717431a6aecce42ae230b437433fAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8d824e69d9f3fa3121b2dda25053bae71e2460d2Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 4.9.337 through 4.9.Not affected 4.14.303 through 4.14.Not affected 4.19.270 through 4.19.Not affected 5.4.229 through 5.4.Not affected 5.10.163 through 5.10.Not affected 5.15.86 through 5.15.Not affected 6.0.16 through 6.0.Not affected 6.1.2 through 6.1.Not affected 6.2 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8c40f2dbae603ef0bd21e87c63f54ec59fd88256Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c886c10a6eddb99923b315f42bf63f448883ef9aAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2344f17c0a89c181ab1a9fef57fd8c3bddfd6e30Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 90103ccb6e60aa4efe48993d23d6a528472f2233Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4fd3a11804c8877ff11fec59c5c53f1635331e3eAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 367296925c7625c3969d2a78d7a3e1dee161beb5Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e9e692917c6e10a7066c7a6d092dcdc3d4e329f3Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before bfc9d8f27f89717431a6aecce42ae230b437433fAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8d824e69d9f3fa3121b2dda25053bae71e2460d2Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
4.9.337 through 4.9.*Not affected
4.14.303 through 4.14.*Not affected
4.19.270 through 4.19.*Not affected
5.4.229 through 5.4.*Not affected
5.10.163 through 5.10.*Not affected
5.15.86 through 5.15.*Not affected
6.0.16 through 6.0.*Not affected
6.1.2 through 6.1.*Not affected
6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.