CVE-2026-45960

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: return error when node already exists in hfs_bnode_create

When hfs_bnode_create() finds that a node is already hashed (which should

not happen in normal operation), it currently returns the existing node

without incrementing its reference count. This causes a reference count

inconsistency that leads to a kernel panic when the node is later freed

in hfs_bnode_put():

kernel BUG at fs/hfsplus/bnode.c:676!

BUG_ON(!atomic_read(&node->refcnt))

This scenario can occur when hfs_bmap_alloc() attempts to allocate a node

that is already in use (e.g., when node 0's bitmap bit is incorrectly

unset), or due to filesystem corruption.

Returning an existing node from a create path is not normal operation.

Fix this by returning ERR_PTR(-EEXIST) instead of the node when it's

already hashed. This properly signals the error condition to callers,

which already check for IS_ERR() return values.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References