CVE-2026-45960: Linux Kernel Privilege Escalation Flaw

CVE-2026-45960 Overview

CVE-2026-45960 is a Linux kernel vulnerability in the hfsplus filesystem implementation. The flaw resides in hfs_bnode_create() within fs/hfsplus/bnode.c. When the function discovers a node is already hashed, it returns the existing node without incrementing its reference count. This reference count inconsistency triggers a kernel panic in hfs_bnode_put() via BUG_ON(!atomic_read(&node->refcnt)). The condition can be reached when hfs_bmap_alloc() allocates a node already in use, or through filesystem corruption when mounting a crafted HFS+ image.

Critical Impact
A malformed or corrupted HFS+ filesystem can trigger a kernel BUG_ON at fs/hfsplus/bnode.c:676, resulting in a kernel panic and denial of service.

Affected Products

Linux kernel — hfsplus filesystem module
Stable kernel branches receiving the backported fixes referenced in the upstream commits
Systems mounting untrusted HFS+ filesystem images

Discovery Timeline

2026-05-27 - CVE-2026-45960 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45960

Vulnerability Analysis

The defect is a reference-counting error in the HFS+ B-tree node allocation path. hfs_bnode_create() is intended to create and return a new B-tree node. When the function detects that a node with the same identifier is already present in the hash table, the original implementation returns the cached node without calling the reference count increment routine. Callers treat the returned pointer as a freshly created node and later release it through hfs_bnode_put(). Because the reference count was never bumped, the release path decrements the counter below the expected value and trips the BUG_ON(!atomic_read(&node->refcnt)) assertion at line 676 of fs/hfsplus/bnode.c, halting the kernel.

Root Cause

The root cause is an incorrect error-handling contract in hfs_bnode_create(). Returning an existing hashed node from a create path violates the function's invariant that callers receive either a new node with an owned reference, or an IS_ERR() pointer. The upstream fix changes the behavior so that when a node is already hashed, the function returns ERR_PTR(-EEXIST) instead of the cached node. Callers already test the return value with IS_ERR() and therefore propagate the error correctly without triggering the assertion.

Attack Vector

Reaching the buggy code path requires interaction with the hfsplus driver. The most realistic trigger is mounting a crafted or corrupted HFS+ image — for example, when a removable device is auto-mounted or when hfs_bmap_alloc() is invoked against a filesystem whose node 0 bitmap bit is incorrectly unset. The result is a kernel panic affecting availability. The vulnerability does not require network access and depends on local privileges or physical access sufficient to mount an HFS+ volume. See the upstream patches at the Kernel Git Commit 1ca4287 and Kernel Git Commit 7b57ada for the exact code change.

Detection Methods for CVE-2026-45960

Indicators of Compromise

Kernel panic messages referencing kernel BUG at fs/hfsplus/bnode.c:676 in dmesg or /var/log/kern.log.
Call stack entries containing hfs_bnode_put, hfs_bnode_create, or hfs_bmap_alloc immediately before the panic.
Unexpected mount operations of HFS+ images from removable media or user-supplied loop devices.

Detection Strategies

Audit kernel logs for BUG_ON assertions originating in fs/hfsplus/.
Inventory kernel build versions to identify hosts running unpatched hfsplus modules.
Track mount system call telemetry for filesystems of type hfsplus, particularly from non-administrative contexts.

Monitoring Recommendations

Forward kernel ring buffer events to centralized logging for cross-host correlation of panic signatures.
Alert on repeated host crashes that share the hfs_bnode_create / hfs_bnode_put stack trace.
Monitor auto-mount daemons such as udisks2 for HFS+ mount events on production servers where this filesystem is not expected.

How to Mitigate CVE-2026-45960

Immediate Actions Required

Apply the upstream stable kernel update that includes the fix in hfs_bnode_create().
Disable or blacklist the hfsplus kernel module on systems that do not require HFS+ support.
Restrict the ability of unprivileged users to mount filesystems, including disabling automatic mounting of removable media on servers.

Patch Information

The fix replaces the silent return of an already-hashed node with ERR_PTR(-EEXIST), properly signaling the error condition to callers. The change has been backported across multiple stable trees. Refer to the upstream commits: Kernel Git Commit 1ca4287, Kernel Git Commit 2e6ff6a, Kernel Git Commit 2e9185a, Kernel Git Commit 507a1de, Kernel Git Commit 5183811, Kernel Git Commit 7b57ada, Kernel Git Commit 9864551, and Kernel Git Commit d8a73cc.

Workarounds

Blacklist the hfsplus module to prevent the vulnerable code path from being loaded.
Set polling and auto-mount policies to ignore HFS+ volumes on multi-user systems.
Validate HFS+ images with fsck.hfsplus before mounting when handling untrusted media.

bash

# Configuration example
# Prevent the hfsplus module from loading until the kernel is patched
echo 'blacklist hfsplus' | sudo tee /etc/modprobe.d/blacklist-hfsplus.conf
echo 'install hfsplus /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-hfsplus.conf
sudo update-initramfs -u
sudo modprobe -r hfsplus 2>/dev/null || true