CVE-2026-45960

A flaw was found in the Linux kernel's hfsplus filesystem. When the hfs_bnode_create() function attempts to create a node that already exists, it returns the existing node without properly incrementing its reference count. This can occur due to filesystem corruption or when a node is incorrectly marked as available. This inconsistency can lead to a kernel panic, resulting in a Denial of Service (DoS).

Red Hat rates this vulnerability as Moderate because exploitation is limited to a local denial of service via a kernel panic, with no potential for privilege escalation or data confidentiality loss. Triggering the flaw requires mounting a specially crafted or corrupted HFS+ storage volume, an operation typically requiring elevated privileges or physical access to attach removable media. Additionally, the HFS+ filesystem driver is an uncommonly used legacy component not enabled in modern Red Hat Enterprise Linux releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.