{"cve":"CVE-2025-68774","nvd":{"published":"2026-01-13T16:15:56.960","modified":"2026-07-30T06:24:43.557","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create\n\nWhen sync() and link() are called concurrently, both threads may\nenter hfs_bnode_find() without finding the node in the hash table\nand proceed to create it.\n\nThread A:\n  hfsplus_write_inode()\n    -> hfsplus_write_system_inode()\n      -> hfs_btree_write()\n        -> hfs_bnode_find(tree, 0)\n          -> __hfs_bnode_create(tree, 0)\n\nThread B:\n  hfsplus_create_cat()\n    -> hfs_brec_insert()\n      -> hfs_bnode_split()\n        -> hfs_bmap_alloc()\n          -> hfs_bnode_find(tree, 0)\n            -> __hfs_bnode_create(tree, 0)\n\nIn this case, thread A creates the bnode, sets refcnt=1, and hashes it.\nThread B also tries to create the same bnode, notices it has already\nbeen inserted, drops its own instance, and uses the hashed one without\ngetting the node.\n\n```\n\n\tnode2 = hfs_bnode_findhash(tree, cnid);\n\tif (!node2) {                                 <- Thread A\n\t\thash = hfs_bnode_hash(cnid);\n\t\tnode->next_hash = tree->node_hash[hash];\n\t\ttree->node_hash[hash] = node;\n\t\ttree->node_hash_cnt++;\n\t} else {                                      <- Thread B\n\t\tspin_unlock(&tree->hash_lock);\n\t\tkfree(node);\n\t\twait_event(node2->lock_wq,\n\t\t\t!test_bit(HFS_BNODE_NEW, &node2->flags));\n\t\treturn node2;\n\t}\n```\n\nHowever, hfs_bnode_find() requires each call to take a reference.\nHere both threads end up setting refcnt=1. When they later put the node,\nthis triggers:\n\nBUG_ON(!atomic_read(&node->refcnt))\n\nIn this scenario, Thread B in fact finds the node in the hash table\nrather than creating a new one, and thus must take a reference.\n\nFix this by calling hfs_bnode_get() when reusing a bnode newly created by\nanother thread to ensure the refcount is updated correctly.\n\nA similar bug was fixed in HFS long ago in commit\na9dc087fd3c4 (\"fix missing hfs_bnode_get() in __hfs_bnode_create\")\nbut the same issue remained in HFS+ until now.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":[],"references":["https://git.kernel.org/stable/c/152af114287851583cf7e0abc10129941f19466a","https://git.kernel.org/stable/c/39e149d58ef4d7883cbf87448d39d51292fd342d","https://git.kernel.org/stable/c/3b0fc7af50b896d0f3d104e70787ba1973bc0b56","https://git.kernel.org/stable/c/457f795e7abd7770de10216d7f9994a3f12a56d6","https://git.kernel.org/stable/c/5882e7c8cdbb5e254a69628b780acff89c78071e"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:19:41.481987139+00:00"},"epss":{"cve":"CVE-2025-68774","score":0.00587,"percentile":0.48058,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}