CVE-2026-46169

A flaw was found in the Linux kernel's HFS Plus (HFS+) filesystem. A local attacker can exploit this vulnerability by mounting a specially crafted, corrupted HFS+ filesystem. The hfs_brec_read() function fails to validate the size of catalog records, which can lead to the use of uninitialized data. This issue may result in a system crash, causing a Denial of Service (DoS), or potentially lead to information disclosure.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux, as successful exploitation requires local administrative privileges or physical access to mount a malformed HFS+ storage volume. In standard Red Hat deployments, HFS+ filesystems are not automatically mounted or utilized for core operational tasks. Consequently, unprivileged users cannot trigger the denial-of-service condition unless granted explicit rights to attach and mount arbitrary file systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.