Executive brief
The Linux kernel's HFS+ filesystem driver contains a buffer overflow vulnerability in its catalog deletion routine. When closing the last reference to a deleted HFS+ hardlink, the kernel reconstructs a catalog key from a thread record without properly validating the record type or size. An attacker with a corrupted or malicious HFS+ disk image can trigger an out-of-bounds memory write, potentially causing a kernel crash or enabling privilege escalation.
Technical details
The vulnerability is a buffer overflow in the HFS+ filesystem implementation (fs/hfsplus/catalog.c). The hfsplus_delete_cat() function, when called with str==NULL (during unlinked inode cleanup), reads thread.nodeName.length directly from a catalog B-tree node without validating that the record is actually a thread record or that its size matches the name length. This allows an attacker to provide an oversized name length value, causing hfs_bnode_read() to write past the bounds of the catalog search-key allocation. The fix adds validation via hfsplus_brec_read_cat() to bound record reads to sizeof(hfsplus_cat_entry) and verify thread record size matches nodeName.length, along with an explicit check rejecting non-thread records. Local access to a crafted HFS+ image is required to trigger this vulnerability.
Affected products
- Linux Linux kernel all versions since 2.6.12-rc2; patched in stable releases and mainline via commit e2ea5cac61acfc11dad22f1d2d4bc71d56c52a20
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-07-08: other: Patch authored by Kyle Zeng
- 2026-09-14: other: Patch merged into stable and mainline kernel trees