Executive brief
A vulnerability was identified in the Linux kernel's HFS+ filesystem driver where a system lock is not properly released during certain error conditions. This could lead to a system crash or instability when mounting a specifically crafted or corrupted HFS+ volume. The issue primarily affects the availability of the system rather than the confidentiality of user data.
Technical details
A locking bug exists in the hfsplus_fill_super() function within the Linux kernel's HFS+ implementation. The function calls hfs_find_init(), which acquires tree->tree_lock, but fails to call hfs_find_exit() if a subsequent call to hfsplus_cat_build_key() returns an error. This results in the tree data structure being freed while the lock is still held, triggering a 'held lock freed' warning and potential kernel instability. An attacker with the ability to mount a HFS+ filesystem could potentially trigger this error path to cause a Denial of Service (DoS). The issue has been resolved by ensuring hfs_find_exit() is called before jumping to the error cleanup label.
Affected products
- Linux Linux Kernel v6.13-rc1 and later
Timeline
- 2026-05-08: other: Patch authored by Zilin Guan
- 2026-05-14: patched: Patch committed to stable tree
- 2026-06-08: advisory: CVE-2026-46299 published
References
- https://git.kernel.org/stable/c/041acda6d9f96006703466449c10c9a69590c8b9
- https://git.kernel.org/stable/c/3ca80e3012c8be85b4f8d0d20eac8d3b17ff257e
- https://git.kernel.org/stable/c/90c500e4fd83fa33c09bc7ee23b6d9cc487ac733
- https://git.kernel.org/stable/c/bfbcce6a7b0552a390620d9b2c4d2bcb1825cbdc
- https://git.kernel.org/stable/c/d309d3308de658d87c42d97e044c89a226327526