CVE-2026-43268 hfsplus: pretend special inodes as regular files
The Linux kernel hfsplus filesystem now treats special inodes as regular files to comply with VFS mode checks, preventing potential access issues.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43268?
CVE-2026-43268 is a medium-severity vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
hfsplus: pretend special inodes as regular files
Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()") requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/ S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes.
Which versions are affected by CVE-2026-43268?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43268?
Apply the vendor's patch.
Is CVE-2026-43268 being exploited?
There is no known exploitation of CVE-2026-43268 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43268, DEBIAN-CVE-2026-43268, GHSA-9wc3-g8j8-wv5q, ROOT-OS-DEBIAN-11-CVE-2026-43268, ROOT-OS-UBUNTU-2204-CVE-2026-43268, ROOT-OS-UBUNTU-2404-CVE-2026-43268 and 1 more.