A flaw in the Linux kernel’s handling of HFS+ catalog records may read fewer bytes than expected, leaving parts of a data structure uninitialized. This represents a violation of CWE-1284 (Use of uninitialized value) as well as CWE-908 (Uninitialized memory processing). When the partially populated structure is later used for string comparison, the uninitialized bytes are read, triggering potential misuse such as memory sanitizer warnings and unpredictable behaviour. The weakness can lead to subtle bugs and may expose sensitive data or cause program instability. Since the issue arises during mounting of a corrupted or malicious HFS+ filesystem, the attack surface is restricted to processes that mount or read such filesystems.

The vulnerability affects all Linux kernels that include the HFS+ filesystem driver, as indicated by the vendor/product entry "Linux:Linux" and the associated CPE string for the Linux kernel. Specific kernel versions are not enumerated in the data, so any Linux distribution running a kernel that lacks the recent fix is potentially vulnerable.

The CVSS score of 5.5 indicates moderate severity, and EPSS <1% indicates very low exploitation probability; the vulnerability is not listed in CISA KEV, which suggests it is not an actively exploited weakness. However, the flaw can be triggered by presenting a malformed HFS+ image to any user or process that mounts that filesystem, which could be used to cause memory corruption or crash service processes. The risk therefore remains moderate, primarily limited to environments that accept HFS+ volumes from untrusted or external sources.