Executive brief
A vulnerability exists in the Linux kernel's HFS+ file system driver, which is used to read and write disks formatted for Apple computers. When certain file operations occur simultaneously, the system can mishandle internal memory tracking, leading to a kernel crash. This could result in a complete system shutdown or loss of availability for services relying on the affected machine.
Technical details
A race condition exists in the HFS+ implementation within 'fs/hfsplus/bnode.c'. When 'sync()' and 'link()' are called concurrently, multiple threads may enter '__hfs_bnode_create' for the same node. If one thread creates and hashes a node while another thread finds the already-hashed node, the second thread fails to increment the reference count via 'hfs_bnode_get()'. This results in an underflow when the nodes are later released, triggering a 'BUG_ON' and subsequent kernel panic. The issue has been patched by ensuring 'hfs_bnode_get()' is called when reusing a bnode newly created by another thread.
Affected products
- Linux Linux Kernel 2.6.12 to 6.12.y
Timeline
- 2025-08-29: disclosed: Initial patch submission
- 2026-01-13: advisory: CVE published
- 2026-01-19: patched: Backported to stable branches
References
- https://git.kernel.org/stable/c/152af114287851583cf7e0abc10129941f19466a
- https://git.kernel.org/stable/c/39e149d58ef4d7883cbf87448d39d51292fd342d
- https://git.kernel.org/stable/c/3b0fc7af50b896d0f3d104e70787ba1973bc0b56
- https://git.kernel.org/stable/c/457f795e7abd7770de10216d7f9994a3f12a56d6
- https://git.kernel.org/stable/c/5882e7c8cdbb5e254a69628b780acff89c78071e
- https://git.kernel.org/stable/c/b68dc4134b18a3922cd33439ec614aad4172bc86
- https://git.kernel.org/stable/c/b9d1c6bb5f19460074ce9862cb80be86b5fb0a50