CVE-2026-46299

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: fix held lock freed on hfsplus_fill_super()

hfsplus_fill_super() calls hfs_find_init() to initialize a search

structure, which acquires tree->tree_lock. If the subsequent call to

hfsplus_cat_build_key() fails, the function jumps to the out_put_root

error label without releasing the lock. The later cleanup path then

frees the tree data structure with the lock still held, triggering a

held lock freed warning.

Fix this by adding the missing hfs_find_exit(&fd) call before jumping

to the out_put_root error label. This ensures that tree->tree_lock is

properly released on the error path.

The bug was originally detected on v6.13-rc1 using an experimental

static analysis tool we are developing, and we have verified that the

issue persists in the latest mainline kernel. The tool is specifically

designed to detect memory management issues. It is currently under active

development and not yet publicly available.

We c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References