CVE-2026-64361

A flaw was found in the Linux kernel's HFS/HFS+ filesystem driver. An integer overflow vulnerability exists in the check_and_correct_requested_length function, where a calculation involving off + len can wrap around due to 32-bit arithmetic. This allows an attacker to bypass bounds checks, leading to an out-of-bounds read of approximately 4GB of memory. A local attacker with low privileges could exploit this to potentially disclose sensitive information or cause memory corruption.