CVE-2025-68774

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create<br /> <br /> When sync() and link() are called concurrently, both threads may<br /> enter hfs_bnode_find() without finding the node in the hash table<br /> and proceed to create it.<br /> <br /> Thread A:<br /> hfsplus_write_inode()<br /> -&gt; hfsplus_write_system_inode()<br /> -&gt; hfs_btree_write()<br /> -&gt; hfs_bnode_find(tree, 0)<br /> -&gt; __hfs_bnode_create(tree, 0)<br /> <br /> Thread B:<br /> hfsplus_create_cat()<br /> -&gt; hfs_brec_insert()<br /> -&gt; hfs_bnode_split()<br /> -&gt; hfs_bmap_alloc()<br /> -&gt; hfs_bnode_find(tree, 0)<br /> -&gt; __hfs_bnode_create(tree, 0)<br /> <br /> In this case, thread A creates the bnode, sets refcnt=1, and hashes it.<br /> Thread B also tries to create the same bnode, notices it has already<br /> been inserted, drops its own instance, and uses the hashed one without<br /> getting the node.<br /> <br /> ```<br /> <br /> node2 = hfs_bnode_findhash(tree, cnid);<br /> if (!node2) { next_hash = tree-&gt;node_hash[hash];<br /> tree-&gt;node_hash[hash] = node;<br /> tree-&gt;node_hash_cnt++;<br /> } else { hash_lock);<br /> kfree(node);<br /> wait_event(node2-&gt;lock_wq,<br /> !test_bit(HFS_BNODE_NEW, &amp;node2-&gt;flags));<br /> return node2;<br /> }<br /> ```<br /> <br /> However, hfs_bnode_find() requires each call to take a reference.<br /> Here both threads end up setting refcnt=1. When they later put the node,<br /> this triggers:<br /> <br /> BUG_ON(!atomic_read(&amp;node-&gt;refcnt))<br /> <br /> In this scenario, Thread B in fact finds the node in the hash table<br /> rather than creating a new one, and thus must take a reference.<br /> <br /> Fix this by calling hfs_bnode_get() when reusing a bnode newly created by<br /> another thread to ensure the refcount is updated correctly.<br /> <br /> A similar bug was fixed in HFS long ago in commit<br /> a9dc087fd3c4 ("fix missing hfs_bnode_get() in __hfs_bnode_create")<br /> but the same issue remained in HFS+ until now.