The function __hfs_ext_write_extent() writes extent data to the B-tree node using the length fd->entrylength obtained from the on-disk HFS record without validation. This length can be larger than the actual source buffer HFS_I(inode)->cached_extents (which is only 12 bytes, the size of hfs_extent_rec). An attacker can craft a malicious HFS image and mount it locally, then trigger a writeback by truncating a file, causing the kernel to read beyond the cached_extents buffer and leak up to 84 bytes of kernel memory into the image. Although CVE-2025-38715 addressed similar out-of-bounds issues in the read path and added bounds checks in hfs_bnode_write(), those checks only verify that the write stays within the B-tree node boundaries. A 96-byte write still fits within a typical node, so the overflow persists in the write path. Fix this by adding a validation in __hfs_ext_write_extent() that rejects any write where fd->entrylength does not equal sizeof(hfs_extent_rec). This is consistent with the existing check in the read path. Fixes: a431930c9bac ("hfs: fix slab-out-of-bounds in hfs_bnode_read()") Signed-off-by: Roman Demidov --- fs/hfs/extent.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/hfs/extent.c b/fs/hfs/extent.c index 580c62981dbd..b588410f01c7 100644 --- a/fs/hfs/extent.c +++ b/fs/hfs/extent.c @@ -126,6 +126,8 @@ static int __hfs_ext_write_extent(struct inode *inode, struct hfs_find_data *fd) } else { if (res) return res; + if (fd->entrylength != sizeof(hfs_extent_rec)) + return -EIO; hfs_bnode_write(fd->bnode, HFS_I(inode)->cached_extents, fd->entryoffset, fd->entrylength); HFS_I(inode)->flags &= ~HFS_FLG_EXT_DIRTY; } -- 2.53.0