CVE-2026-43228: Linux Kernel HFS Error Handling Flaw

CVE-2026-43228 Overview

CVE-2026-43228 is a Linux kernel vulnerability in the Hierarchical File System (HFS) driver. The flaw resides in the handling of Catalog Node ID (CNID) count checks within the superblock. A prior change (a06ec283e125) expanded next_id, folder_count, and file_count in the superblock info to 64 bits and added BUG_ON assertions to detect overflow. When a corrupted Master Directory Block (MDB) is mounted, the BUG_ON triggers and crashes the kernel. The issue was reported by syzbot. The patch replaces the BUG_ON with proper error handling, allowing the mount to fail gracefully instead of panicking.

Critical Impact
A crafted or corrupted HFS volume can crash the Linux kernel through a BUG_ON assertion when mounted, resulting in a denial of service.

Affected Products

Linux kernel versions containing commit a06ec283e125 (HFS filesystem driver)
Stable kernel branches receiving the backport via commits b226804532a875c10276168dc55ce752944096bd and b6536c1ced315fa645576d3a39c6e07f2a472962
Systems with HFS filesystem support compiled in or available as a loadable module

Discovery Timeline

2026-05-06 - CVE-2026-43228 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43228

Vulnerability Analysis

The vulnerability exists in the HFS filesystem driver inside the Linux kernel. The HFS superblock structure tracks three CNID-related counters: next_id (the next available catalog node identifier), folder_count, and file_count. Commit a06ec283e125 widened these counters from 32 bits to 64 bits to prevent silent overflow on large or long-lived filesystems.

As part of that change, defensive BUG_ON macros were added to assert that values read from the on-disk Master Directory Block (MDB) remain within expected bounds. BUG_ON is intended to catch unrecoverable kernel invariants. It is not appropriate for validating untrusted on-disk data structures, because corrupted or attacker-controlled metadata can drive the assertion path.

When the HFS driver mounts a volume whose MDB contains values that violate the new bounds, the BUG_ON fires and the kernel panics or oopses. The corrected code path replaces these assertions with explicit error handling that returns a failure to the mount logic.

Root Cause

The root cause is improper input validation of on-disk filesystem metadata, where unchecked corrupt values reach a BUG_ON assertion instead of a normal error return path. This converts a recoverable I/O error into a kernel-level denial of service [CWE-617 reachable assertion class].

Attack Vector

An attacker who can cause a crafted HFS image to be mounted on a target system can trigger the crash. Realistic vectors include automatic mounting of removable media (USB drives, disk images), sandboxes that mount user-supplied filesystem images, and multi-tenant systems that allow unprivileged image mounts. Remote exploitation requires a separate primitive that delivers and mounts the crafted volume.

No verified proof-of-concept code is published. The vulnerability mechanism is described in the upstream commits referenced in the Kernel Git Commit Update and the companion stable backport.

Detection Methods for CVE-2026-43228

Indicators of Compromise

Kernel panic or oops messages referencing hfs source files and a BUG_ON assertion in the call trace following a mount operation.
dmesg entries showing HFS mount attempts immediately preceding a kernel crash or system reboot.
Unexpected reboots or hangs correlated with insertion of removable media or mounting of disk images.

Detection Strategies

Audit kernel logs for BUG: or kernel BUG at fs/hfs/ strings produced when the assertion fires.
Monitor mount syscall telemetry for HFS filesystem types originating from non-administrator contexts or removable devices.
Track kernel version inventory against the patched stable commits to identify unpatched hosts.

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized logging platform and alert on HFS-related panics.
Inventory hosts where the hfs and hfsplus modules are loaded using lsmod collection across the fleet.
Alert on mount events involving filesystem types hfs from auditd mount syscall records.

How to Mitigate CVE-2026-43228

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits b6536c1ced315fa645576d3a39c6e07f2a472962 and b226804532a875c10276168dc55ce752944096bd.
Update to a stable kernel release that includes the HFS error-handling fix from your distribution vendor.
Disable automatic mounting of removable media on systems that do not require HFS support.

Patch Information

The fix replaces the BUG_ON checks in the HFS superblock CNID handling with proper error returns, allowing the mount to fail cleanly when the MDB is corrupted. Patch references: Kernel Git Commit b6536c1c and Kernel Git Commit b2268045. Apply via your distribution's kernel update mechanism (apt, dnf, zypper) and reboot.

Workarounds

Blacklist the hfs kernel module on systems that do not require HFS volume support.
Restrict mount privileges so untrusted users cannot mount arbitrary filesystem images.
Configure udev or desktop automounters to skip HFS volumes from untrusted removable media.

bash

# Blacklist the HFS module to prevent loading
echo "blacklist hfs" | sudo tee /etc/modprobe.d/blacklist-hfs.conf
echo "install hfs /bin/true" | sudo tee -a /etc/modprobe.d/blacklist-hfs.conf
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep hfs