The flaw is an unsigned 32‑bit integer overflow in the HFS/HFSPlus's check_and_correct_requested_length function. When a caller supplies a very large length value, the addition off+len overflows, yielding a small value that passes the bounds check. The subsequent memmove then reads from a location far beyond the node buffer, potentially reading up to ~4 GB of unrelated kernel memory. This kernel memory corruption can expose sensitive data or serve as a stepping stone to arbitrary code execution with elevated privileges.

All Linux kernels that include HFS/HFSPlus file system support are potentially affected. The advisory does not specify an exact kernel version range, so any kernel build prior to the commit that widened the length addition to 64‑bit arithmetic may be vulnerable. This includes typical distributions that ship the stock kernel with HFS/HFSPlus drivers enabled.

The CVSS score of 7.8 indicates high severity. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating low public exploitation activity. However, based on the description, it is inferred that the flaw resides in kernel space and could be triggered by a local attacker who can write to or modify an HFS/HFSPlus volume. The likely attack vector involves crafting an overlarge length during a file‑record removal operation; this inference comes from the mention of hfs_brec_remove and an underflowed subtraction. If such a condition is achieved, the out‑of‑bounds memmove may leak memory, allow privilege escalation, or cause denial of service. Remote exploitation would likely require the file system to be exposed over a network service, a condition not documented.