{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68774", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T10:30:51.035Z", "datePublished": "2026-01-13T15:28:51.379Z", "dateUpdated": "2026-05-11T21:53:05.691Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:53:05.691Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create\n\nWhen sync() and link() are called concurrently, both threads may\nenter hfs_bnode_find() without finding the node in the hash table\nand proceed to create it.\n\nThread A:\n hfsplus_write_inode()\n -> hfsplus_write_system_inode()\n -> hfs_btree_write()\n -> hfs_bnode_find(tree, 0)\n -> __hfs_bnode_create(tree, 0)\n\nThread B:\n hfsplus_create_cat()\n -> hfs_brec_insert()\n -> hfs_bnode_split()\n -> hfs_bmap_alloc()\n -> hfs_bnode_find(tree, 0)\n -> __hfs_bnode_create(tree, 0)\n\nIn this case, thread A creates the bnode, sets refcnt=1, and hashes it.\nThread B also tries to create the same bnode, notices it has already\nbeen inserted, drops its own instance, and uses the hashed one without\ngetting the node.\n\n```\n\n\tnode2 = hfs_bnode_findhash(tree, cnid);\n\tif (!node2) { <- Thread A\n\t\thash = hfs_bnode_hash(cnid);\n\t\tnode->next_hash = tree->node_hash[hash];\n\t\ttree->node_hash[hash] = node;\n\t\ttree->node_hash_cnt++;\n\t} else { <- Thread B\n\t\tspin_unlock(&tree->hash_lock);\n\t\tkfree(node);\n\t\twait_event(node2->lock_wq,\n\t\t\t!test_bit(HFS_BNODE_NEW, &node2->flags));\n\t\treturn node2;\n\t}\n```\n\nHowever, hfs_bnode_find() requires each call to take a reference.\nHere both threads end up setting refcnt=1. When they later put the node,\nthis triggers:\n\nBUG_ON(!atomic_read(&node->refcnt))\n\nIn this scenario, Thread B in fact finds the node in the hash table\nrather than creating a new one, and thus must take a reference.\n\nFix this by calling hfs_bnode_get() when reusing a bnode newly created by\nanother thread to ensure the refcount is updated correctly.\n\nA similar bug was fixed in HFS long ago in commit\na9dc087fd3c4 (\"fix missing hfs_bnode_get() in __hfs_bnode_create\")\nbut the same issue remained in HFS+ until now."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/hfsplus/bnode.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "3b0fc7af50b896d0f3d104e70787ba1973bc0b56", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "39e149d58ef4d7883cbf87448d39d51292fd342d", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b68dc4134b18a3922cd33439ec614aad4172bc86", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b9d1c6bb5f19460074ce9862cb80be86b5fb0a50", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "457f795e7abd7770de10216d7f9994a3f12a56d6", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "5882e7c8cdbb5e254a69628b780acff89c78071e", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "152af114287851583cf7e0abc10129941f19466a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/hfsplus/bnode.c"], "versions": [{"version": "2.6.12", "status": "affected"}, {"version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.248", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.198", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.160", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.120", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.64", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.3", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.10.248"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.15.198"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.1.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.6.120"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.12.64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.18.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3b0fc7af50b896d0f3d104e70787ba1973bc0b56"}, {"url": "https://git.kernel.org/stable/c/39e149d58ef4d7883cbf87448d39d51292fd342d"}, {"url": "https://git.kernel.org/stable/c/b68dc4134b18a3922cd33439ec614aad4172bc86"}, {"url": "https://git.kernel.org/stable/c/b9d1c6bb5f19460074ce9862cb80be86b5fb0a50"}, {"url": "https://git.kernel.org/stable/c/457f795e7abd7770de10216d7f9994a3f12a56d6"}, {"url": "https://git.kernel.org/stable/c/5882e7c8cdbb5e254a69628b780acff89c78071e"}, {"url": "https://git.kernel.org/stable/c/152af114287851583cf7e0abc10129941f19466a"}], "title": "hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create\n\nWhen sync() and link() are called concurrently, both threads may\nenter hfs_bnode_find() without finding the node in the hash table\nand proceed to create it.\n\nThread A:\n hfsplus_write_inode()\n -> hfsplus_write_system_inode()\n -> hfs_btree_write()\n -> hfs_bnode_find(tree, 0)\n -> __hfs_bnode_create(tree, 0)\n\nThread B:\n hfsplus_create_cat()\n -> hfs_brec_insert()\n -> hfs_bnode_split()\n -> hfs_bmap_alloc()\n -> hfs_bnode_find(tree, 0)\n -> __hfs_bnode_create(tree, 0)\n\nIn this case, thread A creates the bnode, sets refcnt=1, and hashes it.\nThread B also tries to create the same bnode, notices it has already\nbeen inserted, drops its own instance, and uses the hashed one without\ngetting the node.\n\n```\n\n\tnode2 = hfs_bnode_findhash(tree, cnid);\n\tif (!node2) { <- Thread A\n\t\thash = hfs_bnode_hash(cnid);\n\t\tnode->next_hash = tree->node_hash[hash];\n\t\ttree->node_hash[hash] = node;\n\t\ttree->node_hash_cnt++;\n\t} else { <- Thread B\n\t\tspin_unlock(&tree->hash_lock);\n\t\tkfree(node);\n\t\twait_event(node2->lock_wq,\n\t\t\t!test_bit(HFS_BNODE_NEW, &node2->flags));\n\t\treturn node2;\n\t}\n```\n\nHowever, hfs_bnode_find() requires each call to take a reference.\nHere both threads end up setting refcnt=1. When they later put the node,\nthis triggers:\n\nBUG_ON(!atomic_read(&node->refcnt))\n\nIn this scenario, Thread B in fact finds the node in the hash table\nrather than creating a new one, and thus must take a reference.\n\nFix this by calling hfs_bnode_get() when reusing a bnode newly created by\nanother thread to ensure the refcount is updated correctly.\n\nA similar bug was fixed in HFS long ago in commit\na9dc087fd3c4 (\"fix missing hfs_bnode_get() in __hfs_bnode_create\")\nbut the same issue remained in HFS+ until now."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nhfsplus: corrige la falta de hfs_bnode_get() en __hfs_bnode_create\n\nCuando sync() y link() se llaman concurrentemente, ambos hilos pueden entrar en hfs_bnode_find() sin encontrar el nodo en la tabla hash y proceder a crearlo.\n\nHilo A:\n hfsplus_write_inode()\n -&gt; hfsplus_write_system_inode()\n -&gt; hfs_btree_write()\n -&gt; hfs_bnode_find(tree, 0)\n -&gt; __hfs_bnode_create(tree, 0)\n\nHilo B:\n hfsplus_create_cat()\n -&gt; hfs_brec_insert()\n -&gt; hfs_bnode_split()\n -&gt; hfs_bmap_alloc()\n -&gt; hfs_bnode_find(tree, 0)\n -&gt; __hfs_bnode_create(tree, 0)\n\nEn este caso, el hilo A crea el bnode, establece refcnt=1 y lo hashea. El hilo B tambi\u00e9n intenta crear el mismo bnode, nota que ya ha sido insertado, descarta su propia instancia y usa el hasheado sin obtener el nodo.\n\n```\n\n\tnode2 = hfs_bnode_findhash(tree, cnid);\n\tif (!node2) { &lt;- Hilo A\n\t\thash = hfs_bnode_hash(cnid);\n\t\tnode-&gt;next_hash = tree-&gt;node_hash[hash];\n\t\ttree-&gt;node_hash[hash] = node;\n\t\ttree-&gt;node_hash_cnt++;\n\t} else { &lt;- Hilo B\n\t\tspin_unlock(&amp;tree-&gt;hash_lock);\n\t\tkfree(node);\n\t\twait_event(node2-&gt;lock_wq,\n\t\t\t!test_bit(HFS_BNODE_NEW, &amp;node2-&gt;flags));\n\t\treturn node2;\n\t}\n```\n\nSin embargo, hfs_bnode_find() requiere que cada llamada tome una referencia. Aqu\u00ed ambos hilos terminan estableciendo refcnt=1. Cuando m\u00e1s tarde liberan el nodo, esto dispara:\n\nBUG_ON(!atomic_read(&amp;node-&gt;refcnt))\n\nEn este escenario, el Hilo B de hecho encuentra el nodo en la tabla hash en lugar de crear uno nuevo, y por lo tanto debe tomar una referencia.\n\nSolucione esto llamando a hfs_bnode_get() al reutilizar un bnode reci\u00e9n creado por otro hilo para asegurar que el contador de referencias se actualice correctamente.\n\nUn error similar fue corregido en HFS hace mucho tiempo en el commit a9dc087fd3c4 ('corrige la falta de hfs_bnode_get() en __hfs_bnode_create') pero el mismo problema permaneci\u00f3 en HFS+ hasta ahora."}], "id": "CVE-2025-68774", "lastModified": "2026-04-15T00:35:42.020", "metrics": {}, "published": "2026-01-13T16:15:56.960", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/152af114287851583cf7e0abc10129941f19466a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/39e149d58ef4d7883cbf87448d39d51292fd342d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3b0fc7af50b896d0f3d104e70787ba1973bc0b56"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/457f795e7abd7770de10216d7f9994a3f12a56d6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5882e7c8cdbb5e254a69628b780acff89c78071e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b68dc4134b18a3922cd33439ec614aad4172bc86"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b9d1c6bb5f19460074ce9862cb80be86b5fb0a50"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create", "id": "2429033", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429033"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nhfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create\nWhen sync() and link() are called concurrently, both threads may\nenter hfs_bnode_find() without finding the node in the hash table\nand proceed to create it.\nThread A:\nhfsplus_write_inode()\n-> hfsplus_write_system_inode()\n-> hfs_btree_write()\n-> hfs_bnode_find(tree, 0)\n-> __hfs_bnode_create(tree, 0)\nThread B:\nhfsplus_create_cat()\n-> hfs_brec_insert()\n-> hfs_bnode_split()\n-> hfs_bmap_alloc()\n-> hfs_bnode_find(tree, 0)\n-> __hfs_bnode_create(tree, 0)\nIn this case, thread A creates the bnode, sets refcnt=1, and hashes it.\nThread B also tries to create the same bnode, notices it has already\nbeen inserted, drops its own instance, and uses the hashed one without\ngetting the node.\n```\nnode2 = hfs_bnode_findhash(tree, cnid);\nif (!node2) { <- Thread A\nhash = hfs_bnode_hash(cnid);\nnode->next_hash = tree->node_hash[hash];\ntree->node_hash[hash] = node;\ntree->node_hash_cnt++;\n} else { <- Thread B\nspin_unlock(&tree->hash_lock);\nkfree(node);\nwait_event(node2->lock_wq,\n!test_bit(HFS_BNODE_NEW, &node2->flags));\nreturn node2;\n}\n```\nHowever, hfs_bnode_find() requires each call to take a reference.\nHere both threads end up setting refcnt=1. When they later put the node,\nthis triggers:\nBUG_ON(!atomic_read(&node->refcnt))\nIn this scenario, Thread B in fact finds the node in the hash table\nrather than creating a new one, and thus must take a reference.\nFix this by calling hfs_bnode_get() when reusing a bnode newly created by\nanother thread to ensure the refcount is updated correctly.\nA similar bug was fixed in HFS long ago in commit\na9dc087fd3c4 (\"fix missing hfs_bnode_get() in __hfs_bnode_create\")\nbut the same issue remained in HFS+ until now."], "name": "CVE-2025-68774", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-01-13T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-68774\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68774\nhttps://lore.kernel.org/linux-cve-announce/2026011358-CVE-2025-68774-f2fd@gregkh/T"], "threat_severity": "Moderate"}

{}