CVE-2025-68774

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create

When sync() and link() are called concurrently, both threads may

enter hfs_bnode_find() without finding the node in the hash table

and proceed to create it.

Thread A:

hfsplus_write_inode()

-> hfsplus_write_system_inode()

-> hfs_btree_write()

-> hfs_bnode_find(tree, 0)

-> __hfs_bnode_create(tree, 0)

Thread B:

hfsplus_create_cat()

-> hfs_brec_insert()

-> hfs_bnode_split()

-> hfs_bmap_alloc()

-> hfs_bnode_find(tree, 0)

-> __hfs_bnode_create(tree, 0)

In this case, thread A creates the bnode, sets refcnt=1, and hashes it.

Thread B also tries to create the same bnode, notices it has already

been inserted, drops its own instance, and uses the hashed one without

getting the node.

```

node2 = hfs_bnode_findhash(tree, cnid);

if (!node2) { <- Thread A

hash =

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References