CVE-2026-74414

A flaw was found in the Linux kernel's HFS Plus (hfsplus) filesystem. A local user could trigger a null-pointer dereference by executing the setxattr function in userspace when the attributes file is not properly loaded during system mount. This vulnerability is caused by a duplicate attribute inode dirty marking action. Successful exploitation of this flaw could lead to a system crash, resulting in a Denial of Service (DoS).

A moderate-impact flaw was found in the Linux kernel's HFS Plus (hfsplus) filesystem. A local user could trigger a null-pointer dereference in hfsplus_setxattr by calling setxattr from userspace when the attributes file was not loaded during system mount, caused by a duplicate attribute inode dirty marking operation; successful exploitation crashes the kernel, resulting in a denial of service. All Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS (kernel and kernel-ivos-qualcomm) streams assessed for this flaw are not affected, because the vulnerable code is not present in the shipped Red Hat kernels, so no Red Hat product is exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.