CVE-2026-45960 hfsplus: return error when node already exists in hfs_bnode_create
A reference count inconsistency in the HFS+ filesystem driver can cause a kernel panic, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45960?
CVE-2026-45960 is a medium-severity vulnerability in Linux kernel, published on 27 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
hfsplus: return error when node already exists in hfs_bnode_create
When hfs_bnode_create() finds that a node is already hashed (which should not happen in normal operation), it currently returns the existing node without incrementing its reference count. This causes a reference count inconsistency that leads to a kernel panic when the node is later freed in hfs_bnode_put():
kernel BUG at fs/hfsplus/bnode.c:676! BUG_ON(!atomic_read(&node->refcnt))
This scenario can occur when hfs_bmap_alloc() attempts to allocate a node that is already in use (e.g., when node 0's bitmap bit is incorrectly unset), or due to filesystem corruption.
Returning an existing node from a create path is not normal operation.
Fix this by returning ERR_PTR(-EEXIST) instead of the node when it's already hashed. This properly signals the error condition to callers, which already check for IS_ERR() return values.
Which versions are affected by CVE-2026-45960?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-45960?
Apply the vendor's patch.
Is CVE-2026-45960 being exploited?
There is no known exploitation of CVE-2026-45960 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-45960, DEBIAN-CVE-2026-45960, GHSA-3j7g-p6x3-6qqj, ROOT-OS-DEBIAN-11-CVE-2026-45960, ROOT-OS-UBUNTU-2204-CVE-2026-45960, ROOT-OS-UBUNTU-2404-CVE-2026-45960 and 1 more.