Executive brief
The HFS filesystem driver in the Linux kernel contains a reference counting bug that can cause the kernel to crash during filesystem operations. When the filesystem attempts to write data, a missing reference increment leads to an incorrect reference count check that triggers a kernel panic, causing a denial of service.
Technical details
The vulnerability is a reference counting error in the HFS filesystem driver (fs/hfs/bnode.c). When __hfs_bnode_create() allocates a B-tree node, it initializes its reference count to 1. During the write path (hfs_btree_write), the code calls hfs_bnode_find() which may locate an existing node via hfs_bnode_findhash() without incrementing its reference count. When hfs_bnode_put() is subsequently called, it triggers a BUG_ON() assertion because the reference count reaches 0 prematurely. The attack requires local filesystem access (e.g., mounting a malicious HFS image or crafted filesystem operation via writeback). The fix adds a missing hfs_bnode_get() call to properly increment the reference count when an existing node is reused.
Affected products
- Linux Linux kernel 6.1.0-rc7 and earlier versions with HFS support
Timeline
- 2025-12-09: disclosed
- 2023: advisory: CVE-2023-53862 assigned