CVE-2026-93095

A flaw was found in the HFS Plus (HFS+) filesystem in the Linux kernel. A local attacker could provide a specially crafted, corrupted HFS+ image that, when processed during a delete key rebuild operation, would cause the system to write past an allocated memory buffer. This out-of-bounds write could lead to memory corruption, potentially resulting in a denial of service or other unspecified impacts.

A corrupted HFS Plus catalog thread record can make hfsplus_delete_cat() rebuild a delete key from an unvalidated nodeName length. The old path reads the length from the catalog B tree and copies length times 2 bytes into fd.search_key, which can write past the allocated search key buffer. This is a kernel out-of-bounds write rather than a pure crash-only condition, so the realistic impact is at least local denial of service and the worst case may include confidentiality or integrity impact through memory corruption. For the CVSS the PR:L is used because reliable triggering needs local ability to get a crafted HFS Plus image processed, and in practical desktop or removable media deployments this may be available through user mount, automount, or storage management services rather than full administrator control. The issue is not directly network reachable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.