Medium 5.5Published May 27, 2026

CVE-2026-45960hfsplus: return error when node already exists in hfs_bnode_create

Updated under an hour ago (Oct 26, 2026, 2:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: hfsplus: return error when node already exists in hfs_bnode_create When hfs_bnode_create() finds that a node is already hashed (which should not happen in normal operation), it currently returns the existing node without incrementing its reference count. This causes a reference count inconsistency that leads to a kernel panic when the node is later freed in hfs_bnode_put(): kernel BUG at fs/hfsplus/bnode.c:676! BUG_ON(!atomic_read(&node->refcnt)) This scenario can occur when hfs_bmap_alloc() attempts to allocate a node that is already in use (e.g., when node 0's bitmap bit is incorrectly unset), or due to filesystem corruption. Returning an existing node from a create path is not normal operation. Fix this by returning ERR_PTR(-EEXIST) instead of the node when it's already hashed. This properly signals the error condition to callers, which already check for IS_ERR() return values.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 27, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	634725a92938b0f282b17cec0b007dca77adebd2 builds before 1ca428769cb4737a25bd32fb4d1573cc09eeaeef; 634725a92938b0f282b17cec0b007dca77adebd2 builds before 507a1de58c21c95ad7c44afccaf1222d1c42246b; from 634725a92938b0f282b17cec0b007dca77adebd2 before 986455135b95f32c1f142068e451098fc751749e; 634725a92938b0f282b17cec0b007dca77adebd2 builds before 7b57ada854b32310f224abd61bcfec2d5790ff0a; from 634725a92938b0f282b17cec0b007dca77adebd2 before 51838112d9c22502333c3085ca0c0d691e7093c6; 634725a92938b0f282b17cec0b007dca77adebd2 builds before 2e6ff6a6fc69cc17ed10c9cb6242935d52acd52d; 634725a92938b0f282b17cec0b007dca77adebd2 builds before 2e9185a42e0e237c74435fd092b7c34537c62156; from 634725a92938b0f282b17cec0b007dca77adebd2 before d8a73cc46c8462a969a7516131feb3096f4c49d3	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.16.1 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.14; from 6.19 before 6.19.4; 2.6.16; and 5 more ranges	NVD

References

References

https://git.kernel.org/stable/c/1ca428769cb4737a25bd32fb4d1573cc09eeaeef	patch
https://git.kernel.org/stable/c/507a1de58c21c95ad7c44afccaf1222d1c42246b	patch
https://git.kernel.org/stable/c/986455135b95f32c1f142068e451098fc751749e	patch
https://git.kernel.org/stable/c/7b57ada854b32310f224abd61bcfec2d5790ff0a	patch
https://git.kernel.org/stable/c/51838112d9c22502333c3085ca0c0d691e7093c6	patch
https://git.kernel.org/stable/c/2e6ff6a6fc69cc17ed10c9cb6242935d52acd52d	patch
https://git.kernel.org/stable/c/2e9185a42e0e237c74435fd092b7c34537c62156	patch
https://git.kernel.org/stable/c/d8a73cc46c8462a969a7516131feb3096f4c49d3	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.