CVE-2026-46299: Linux Kernel HFS+ Lock Handling Vulnerability

Technical summary

The vulnerability exists in hfsplus_fill_super(), which initializes a search structure via hfs_find_init() to acquire tree->tree_lock. If hfsplus_cat_build_key() fails—specifically when hfsplus_asc2uni() returns -ENAMETOOLONG due to name string length validation—the error path jumps to out_put_root without calling hfs_find_exit(&fd) to release the lock. The kernel's lockdep mechanism detects this held lock on a freed memory region, triggering a 'held lock freed' warning. The fix is straightforward: add hfs_find_exit(&fd) before the problematic jump to ensure lock release on all error paths.

Business impact

This vulnerability primarily affects systems running HFS+ filesystems on Linux, which is increasingly rare in enterprise environments but may be present in systems managing macOS-formatted storage devices or legacy systems. The impact is local denial of service through filesystem mount failure or potential privilege escalation from an unprivileged user to kernel-level access. Organizations with HFS+ workloads face availability risk if an attacker can trigger the faulty code path, and the HIGH severity score reflects the potential for privilege escalation.

Affected systems

The vulnerability affects the Linux kernel across all versions through at least the current mainline branch (verified on v6.13-rc1 and later). Any Linux system with CONFIG_HFSPLUS_FS enabled is vulnerable, particularly those mounting HFS+ partitions. The vulnerability is triggered during mount time, so persistent exposure requires either regularly mounting untrusted HFS+ media or misconfigured automatic mounting.

Exploitability

Exploitability is moderate. An attacker requires local access and sufficient privilege to attempt filesystem mount operations (typically unprivileged users can attempt this via unprivileged namespaces or with explicit mount capability). Triggering the bug requires either crafting a malformed HFS+ filesystem image with pathologically long filenames or using a debugging tool to modify kernel state. The CVSS vector (AV:L/AC:H/PR:L/UI:N) correctly reflects that exploitation requires local access and high complexity (AC:H), though the consequences—privilege escalation and system compromise—are severe.

Remediation

Apply the kernel patch adding hfs_find_exit(&fd) before the out_put_root label in hfsplus_fill_super(). For immediate mitigation, disable HFS+ support by setting CONFIG_HFSPLUS_FS=n at kernel build time if the filesystem is not required. Alternatively, implement filesystem mount restrictions or AppArmor/SELinux policies to prevent untrusted HFS+ media from being mounted. Monitor for subsequent upstream kernel releases containing this fix.

Patch guidance

Check your Linux kernel version and configuration. If CONFIG_HFSPLUS_FS is enabled, prioritize patching when the fix is released upstream (typically in the next stable kernel series after mainline merge). Verify the patch against the official Linux kernel repository commit that resolves this issue. Backports to active stable branches (6.1.x, 6.6.x, 6.9.x, etc.) should be expected within weeks of upstream merge. Apply patches during your standard kernel update cycle, prioritizing systems that actively mount HFS+ filesystems.

Detection guidance

Monitor kernel logs for 'held lock freed' warnings related to hfsplus_fill_super or hfs_find_init during filesystem mount operations. Lockdep must be enabled (CONFIG_LOCKDEP=y) to detect this warning. Kernel audit logs will show mount attempts on HFS+ filesystems; correlate these with system stability issues. Note that the vulnerability is triggered at mount time, so detection requires observing the mount operation itself—there is no runtime signal during normal filesystem use.

Why prioritize this

While the CVSS score is HIGH (7.0) due to potential privilege escalation and system compromise, the practical urgency depends on your HFS+ usage. Organizations without HFS+ support enabled can defer this patch. Those mounting HFS+ filesystems, particularly from untrusted sources, should prioritize patching. The attack complexity being high (AC:H) and the requirement for local access limit the threat profile for most enterprise environments, but the privilege escalation vector warrants attention in multi-user or container environments where unprivileged users can mount filesystems.

Risk score, explained

The CVSS 3.1 score of 7.0 (HIGH) reflects a local attack vector with unprivileged requirements, high attack complexity, and severe impact (confidentiality, integrity, and availability all HIGH). The score appropriately captures that exploitation is not trivial but the consequences are kernel-level compromise. The absence from the CISA KEV catalog suggests limited real-world exploitation detected to date, reducing temporal risk. For organizations with HFS+ disabled or unused, the practical risk is lower; for those actively using HFS+, the score accurately represents the severity.

Frequently asked questions