CVE-2026-45960

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hfsplus: return error when node already exists in hfs_bnode_create<br /> <br /> When hfs_bnode_create() finds that a node is already hashed (which should<br /> not happen in normal operation), it currently returns the existing node<br /> without incrementing its reference count. This causes a reference count<br /> inconsistency that leads to a kernel panic when the node is later freed<br /> in hfs_bnode_put():<br /> <br /> kernel BUG at fs/hfsplus/bnode.c:676!<br /> BUG_ON(!atomic_read(&amp;node-&gt;refcnt))<br /> <br /> This scenario can occur when hfs_bmap_alloc() attempts to allocate a node<br /> that is already in use (e.g., when node 0&amp;#39;s bitmap bit is incorrectly<br /> unset), or due to filesystem corruption.<br /> <br /> Returning an existing node from a create path is not normal operation.<br /> <br /> Fix this by returning ERR_PTR(-EEXIST) instead of the node when it&amp;#39;s<br /> already hashed. This properly signals the error condition to callers,<br /> which already check for IS_ERR() return values.