CVE-2026-45960hfsplus: return error when node already exists in hfs_bnode_create
- 5.5MediumCVSS base score
- 0.12%Exploitation in 30 daysEPSS · top 98% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: hfsplus: return error when node already exists in hfs_bnode_create When hfs_bnode_create() finds that a node is already hashed (which should not happen in normal operation), it currently returns the existing node without incrementing its reference count. This causes a reference count inconsistency that leads to a kernel panic when the node is later freed in hfs_bnode_put(): kernel BUG at fs/hfsplus/bnode.c:676! BUG_ON(!atomic_read(&node->refcnt)) This scenario can occur when hfs_bmap_alloc() attempts to allocate a node that is already in use (e.g., when node 0's bitmap bit is incorrectly unset), or due to filesystem corruption. Returning an existing node from a create path is not normal operation. Fix this by returning ERR_PTR(-EEXIST) instead of the node when it's already hashed. This properly signals the error condition to callers, which already check for IS_ERR() return values.
Timeline
ID reserved
By Linux
- 14 days later
· 14 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.12% · top 98% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 634725a92938b0f282b17cec0b007dca77adebd2 – < 1ca428769cb4737a25bd32fb4d1573cc09eeaeef
- affected 634725a92938b0f282b17cec0b007dca77adebd2 – < 507a1de58c21c95ad7c44afccaf1222d1c42246b
- affected 634725a92938b0f282b17cec0b007dca77adebd2 – < 986455135b95f32c1f142068e451098fc751749e
- affected 634725a92938b0f282b17cec0b007dca77adebd2 – < 7b57ada854b32310f224abd61bcfec2d5790ff0a
- affected 634725a92938b0f282b17cec0b007dca77adebd2 – < 51838112d9c22502333c3085ca0c0d691e7093c6
- affected 634725a92938b0f282b17cec0b007dca77adebd2 – < 2e6ff6a6fc69cc17ed10c9cb6242935d52acd52d
- affected 634725a92938b0f282b17cec0b007dca77adebd2 – < 2e9185a42e0e237c74435fd092b7c34537c62156
- affected 634725a92938b0f282b17cec0b007dca77adebd2 – < d8a73cc46c8462a969a7516131feb3096f4c49d3
- affected 2.6.16
- unaffected < 2.6.16
- unaffected 5.10.252 – ≤ 5.10.*
- unaffected 5.15.202 – ≤ 5.15.*
- unaffected 6.1.165 – ≤ 6.1.*
- unaffected 6.6.128 – ≤ 6.6.*
- unaffected 6.12.75 – ≤ 6.12.*
- unaffected 6.18.14 – ≤ 6.18.*
- unaffected 6.19.4 – ≤ 6.19.*
- unaffected 7.0 – ≤ *
References
References8
- https://git.kernel.org/stable/c/1ca428769cb4737a25bd32fb4d1573cc09eeaeef (opens in a new tab)
- https://git.kernel.org/stable/c/507a1de58c21c95ad7c44afccaf1222d1c42246b (opens in a new tab)
- https://git.kernel.org/stable/c/986455135b95f32c1f142068e451098fc751749e (opens in a new tab)
- https://git.kernel.org/stable/c/7b57ada854b32310f224abd61bcfec2d5790ff0a (opens in a new tab)
- https://git.kernel.org/stable/c/51838112d9c22502333c3085ca0c0d691e7093c6 (opens in a new tab)
- https://git.kernel.org/stable/c/2e6ff6a6fc69cc17ed10c9cb6242935d52acd52d (opens in a new tab)
- https://git.kernel.org/stable/c/2e9185a42e0e237c74435fd092b7c34537c62156 (opens in a new tab)
- https://git.kernel.org/stable/c/d8a73cc46c8462a969a7516131feb3096f4c49d3 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-32244 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-45960)Record last updated .