The Linux kernel's HFS filesystem had a vulnerability identified by syzbot involving uninitialized memory usage in hfs_find_set_zero_bits(). The root cause was that the bitmap buffer allocated with kmalloc() was not zeroed, allowing garbage data to influence bitmap operations. This could lead to volume corruption and filesystem driver bugs. The patch replaced kmalloc() with kzalloc() to guarantee zero-initialized memory for the bitmap, ensuring correctness of bitmap operations and preventing corruption.

If uninitialized memory contains non-zero garbage, it can corrupt the bitmap used by the HFS filesystem, potentially causing volume corruption and filesystem driver malfunctions. The CVSS vector indicates local attack vector with low complexity and low privileges required, but with high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The issue was fixed by replacing kmalloc() with kzalloc() in the Linux kernel source code for the HFS filesystem. Users should apply the official Linux kernel updates once available that include this fix.