Executive brief
A vulnerability in the Linux kernel's HPFS file system driver can cause the entire system to crash. This occurs when the system attempts to process a specific type of file system structure (dnode bitmap) and encounters an error, leading to an improper memory operation. An attacker could potentially exploit this to cause a denial-of-service, disrupting operations and system availability.
Technical details
A vulnerability in the Linux kernel HPFS (High Performance File System) driver, specifically within 'fs/hpfs/alloc.c', can lead to a kernel panic. The issue arises in the 'hpfs_check_free_dnodes' function: if 'hpfs_map_dnode_bitmap' fails, the error handling path incorrectly calls 'hpfs_brelse4' on an uninitialized quad buffer head (qbh). This uninitialized pointer dereference results in a system crash. The vulnerability is reachable locally if HPFS partitions are mounted. Patches have been released across multiple stable kernel branches (5.10.y, 5.15.y, 6.1.y, 6.6.y, 6.12.y, 6.18.y, and 7.0.y).
Affected products
- Linux Linux Kernel All versions before 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12
Timeline
- 2026-05-25: other: Vulnerability fix authored
- 2026-06-19: patched: Fix committed to stable tree
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/010b08084000ef018f1a8de5197087f3b91d8cfe
- https://git.kernel.org/stable/c/0886c6f257fe3663f80218aa1919b0f3f21bf22c
- https://git.kernel.org/stable/c/1648a3c7f4e18f46a4881920133fc4f2494185a0
- https://git.kernel.org/stable/c/1d73a533760bc5abb83b3cc759133596f7bb708f
- https://git.kernel.org/stable/c/4f37bb30b57d6d403d02673074555bd3c3602bef
- https://git.kernel.org/stable/c/7c58c55a2a16f7274772507bd1637be609351b4f
- https://git.kernel.org/stable/c/974820a59efde7c1a7e1260bcfe9bb81f833cc9f