In the Linux kernel, the following vulnerability has been resolved:

hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length

check_and_correct_requested_length() compares (off + len) against
node_size using u32 arithmetic.  When the caller passes a large len
value (e.g. from an underflowed subtraction in hfs_brec_remove()),
off + len can wrap past 2^32 and produce a small result, causing the
bounds check to pass when it should fail.

For example, with off=14 and len=0xFFFFFFF2 (underflowed from
data_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6,
which is less than a typical node_size of 512, so the check passes and
the subsequent memmove reads ~4GB past the node buffer.

Fix this by widening the addition to u64 before comparing against
node_size.  This prevents the u32 wrap while keeping the logic
straightforward.

https://git.kernel.org/stable/c/607217f7ad419b53926f71e3f75001813bbc08ad

https://git.kernel.org/stable/c/671c3fcc2ad31c1311ea6414382a2d95104ae1b9

https://git.kernel.org/stable/c/7399c3baee7bb622a92f0b895cd4d3009a693f2b

https://git.kernel.org/stable/c/966cb76fb2857a4242cab6ea2ea17acf818a3da7

https://git.kernel.org/stable/c/b6a481642ea1977be2f84dc08c5affd742c177e7

https://git.kernel.org/stable/c/c25d3c931a63e762fcaa9cb125b901c53b62403f

https://git.kernel.org/stable/c/c8dd112173c02adf539fe2ad34a45f5e0068780d

https://git.kernel.org/stable/c/fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/hfs/bnode.c","fs/hfsplus/hfsplus_fs.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"67ecc81f6492275c9c54280532f558483c99c90e","lessThan":"c8dd112173c02adf539fe2ad34a45f5e0068780d","versionType":"git","status":"affected"},{"version":"a1a60e79502279f996e55052f50cc14919020475","lessThan":"fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1","versionType":"git","status":"affected"},{"version":"fe2891a9c43ab87d1a210d61e6438ca6936e2f62","lessThan":"671c3fcc2ad31c1311ea6414382a2d95104ae1b9","versionType":"git","status":"affected"},{"version":"384a66b89f9540a9a8cb0f48807697dfabaece4c","lessThan":"b6a481642ea1977be2f84dc08c5affd742c177e7","versionType":"git","status":"affected"},{"version":"efc095b35b23297e419c2ab4fc1ed1a8f0781a29","lessThan":"7399c3baee7bb622a92f0b895cd4d3009a693f2b","versionType":"git","status":"affected"},{"version":"a431930c9bac518bf99d6b1da526a7f37ddee8d8","lessThan":"607217f7ad419b53926f71e3f75001813bbc08ad","versionType":"git","status":"affected"},{"version":"a431930c9bac518bf99d6b1da526a7f37ddee8d8","lessThan":"c25d3c931a63e762fcaa9cb125b901c53b62403f","versionType":"git","status":"affected"},{"version":"a431930c9bac518bf99d6b1da526a7f37ddee8d8","lessThan":"966cb76fb2857a4242cab6ea2ea17acf818a3da7","versionType":"git","status":"affected"},{"version":"e7d2dc2421e821e4045775e6dc226378328de6f6","versionType":"git","status":"affected"},{"version":"fc7f732984ec91f30be3e574e0644066d07f2b78","versionType":"git","status":"affected"},{"version":"eec522fd0d28106b14a59ab2d658605febe4a3bb","versionType":"git","status":"affected"},{"version":"5.10.241","lessThan":"5.10.261","versionType":"semver","status":"affected"},{"version":"5.15.190","lessThan":"5.15.212","versionType":"semver","status":"affected"},{"version":"6.1.149","lessThan":"6.1.178","versionType":"semver","status":"affected"},{"version":"6.6.103","lessThan":"6.6.145","versionType":"semver","status":"affected"},{"version":"6.12.43","lessThan":"6.12.97","versionType":"semver","status":"affected"},{"version":"5.4.297","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"6.15.11","lessThan":"6.16","versionType":"semver","status":"affected"},{"version":"6.16.2","lessThan":"6.17","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/hfs/bnode.c","fs/hfsplus/hfsplus_fs.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.4","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]