Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-93095

hfsplus: validate thread record before delete key rebuild

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: hfsplus: validate thread record before delete key rebuild hfsplus_delete_cat() is called with str == NULL when the last open reference to an unlinked HFS+ hardlink backing inode is closed. In that case, the function finds the catalog thread by CNID and rebuilds the catalog key from thread.nodeName. That reconstruction path reads thread.nodeName.length directly from the catalog B-tree into fd.search_key and then copies length * 2 bytes into fd.search_key->cat.name.unicode. It does not first check that the found record is a thread record or that its size matches the thread name. A corrupted image can therefore provide an oversized thread name length and make hfs_bnode_read() write past the catalog search-key allocation. Read the CNID record through hfsplus_brec_read_cat(), which bounds the record read to sizeof(hfsplus_cat_entry) and verifies that a thread record's size exactly matches nodeName.length. Together, these checks ensure an accepted thread name fits HFSPLUS_MAX_STRLEN. Reject non-thread records before building the delete key from the validated thread name. Share the thread-record-type helper between hfsplus_find_cat() and hfsplus_delete_cat().

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 33cda0036bc683fc888c20b04a5fc030e3e8413b; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in b9729c51a8b67f8b20b8a8cf395da4be63a0c15b; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in af48abc1b00d865c3f4c4d76b901c44115cb7162; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in e20f3b749ad241df77ec1c3e13a9c22209aa1eb3; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 7898beee166c1145c0bca364d687b8437435bf1a; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in e31985c67ba00a59d9b1340af473c1dbe6c87856; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 473ea7aa35615829f0de7a71e8691d69dc24e328; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in e2ea5cac61acfc11dad22f1d2d4bc71d56c52a20

  • Linux Linux

    2.6.12

  • KernelLinux

    From 2.6.12 · fixed in 5.10.270; From 5.11.0 · fixed in 5.15.221; From 5.16.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6

References 8

git.kernel.org