CVE-2025-68774

A race condition was found in the Linux kernel's HFS+ filesystem. When sync() and link() are called concurrently, two threads may attempt to create the same bnode simultaneously. If one thread reuses a bnode newly created by another thread without properly incrementing the reference count, a subsequent put operation triggers a BUG_ON due to an incorrect refcount, causing a kernel crash.

This flaw affects systems mounting HFS+ filesystems and requires concurrent filesystem operations to trigger the race condition. While the bug can cause a kernel crash, exploitation requires local access and specific timing during HFS+ operations. Most enterprise deployments do not commonly use HFS+ filesystems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the hfsplus module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.