CVE-2026-46299 (GCVE-0-2026-46299)

Vulnerability from cvelistv5 – Published: 2026-06-08 15:46 – Updated: 2026-08-05 12:31
VLAI
Title
hfsplus: fix held lock freed on hfsplus_fill_super()
Summary
In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix held lock freed on hfsplus_fill_super() hfsplus_fill_super() calls hfs_find_init() to initialize a search structure, which acquires tree->tree_lock. If the subsequent call to hfsplus_cat_build_key() fails, the function jumps to the out_put_root error label without releasing the lock. The later cleanup path then frees the tree data structure with the lock still held, triggering a held lock freed warning. Fix this by adding the missing hfs_find_exit(&fd) call before jumping to the out_put_root error label. This ensures that tree->tree_lock is properly released on the error path. The bug was originally detected on v6.13-rc1 using an experimental static analysis tool we are developing, and we have verified that the issue persists in the latest mainline kernel. The tool is specifically designed to detect memory management issues. It is currently under active development and not yet publicly available. We confirmed the bug by runtime testing under QEMU with x86_64 defconfig, lockdep enabled, and CONFIG_HFSPLUS_FS=y. To trigger the error path, we used GDB to dynamically shrink the max_unistr_len parameter to 1 before hfsplus_asc2uni() is called. This forces hfsplus_asc2uni() to naturally return -ENAMETOOLONG, which propagates to hfsplus_cat_build_key() and exercises the faulty error path. The following warning was observed during mount: ========================= WARNING: held lock freed! 7.0.0-rc3-00016-gb4f0dd314b39 #4 Not tainted ------------------------- mount/174 is freeing memory ffff888103f92000-ffff888103f92fff, with a lock still held there! ffff888103f920b0 (&tree->tree_lock){+.+.}-{4:4}, at: hfsplus_find_init+0x154/0x1e0 2 locks held by mount/174: #0: ffff888103f960e0 (&type->s_umount_key#42/1){+.+.}-{4:4}, at: alloc_super.constprop.0+0x167/0xa40 #1: ffff888103f920b0 (&tree->tree_lock){+.+.}-{4:4}, at: hfsplus_find_init+0x154/0x1e0 stack backtrace: CPU: 2 UID: 0 PID: 174 Comm: mount Not tainted 7.0.0-rc3-00016-gb4f0dd314b39 #4 PREEMPT(lazy) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x82/0xd0 debug_check_no_locks_freed+0x13a/0x180 kfree+0x16b/0x510 ? hfsplus_fill_super+0xcb4/0x18a0 hfsplus_fill_super+0xcb4/0x18a0 ? __pfx_hfsplus_fill_super+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? bdev_open+0x65f/0xc30 ? srso_return_thunk+0x5/0x5f ? pointer+0x4ce/0xbf0 ? trace_contention_end+0x11c/0x150 ? __pfx_pointer+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? bdev_open+0x79b/0xc30 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? vsnprintf+0x6da/0x1270 ? srso_return_thunk+0x5/0x5f ? __mutex_unlock_slowpath+0x157/0x740 ? __pfx_vsnprintf+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? mark_held_locks+0x49/0x80 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? irqentry_exit+0x17b/0x5e0 ? trace_irq_disable.constprop.0+0x116/0x150 ? __pfx_hfsplus_fill_super+0x10/0x10 ? __pfx_hfsplus_fill_super+0x10/0x10 get_tree_bdev_flags+0x302/0x580 ? __pfx_get_tree_bdev_flags+0x10/0x10 ? vfs_parse_fs_qstr+0x129/0x1a0 ? __pfx_vfs_parse_fs_qstr+0x3/0x10 vfs_get_tree+0x89/0x320 fc_mount+0x10/0x1d0 path_mount+0x5c5/0x21c0 ? __pfx_path_mount+0x10/0x10 ? trace_irq_enable.constprop.0+0x116/0x150 ? trace_irq_enable.constprop.0+0x116/0x150 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? kmem_cache_free+0x307/0x540 ? user_path_at+0x51/0x60 ? __x64_sys_mount+0x212/0x280 ? srso_return_thunk+0x5/0x5f __x64_sys_mount+0x212/0x280 ? __pfx___x64_sys_mount+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? trace_irq_enable.constprop.0+0x116/0x150 ? srso_return_thunk+0x5/0x5f do_syscall_64+0x111/0x680 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ffacad55eae Code: 48 8b 0d 85 1f 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 8 RSP: 002b ---truncated---
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 89ac9b4d3d1a049ae1054f99b1aed81092cd0a82 , < e890656accee4c26d932ea388eb8936a6e22184d (git)
Affected: 89ac9b4d3d1a049ae1054f99b1aed81092cd0a82 , < 6499c9c8ec437a369e7e221dad91f6122b50759d (git)
Affected: 89ac9b4d3d1a049ae1054f99b1aed81092cd0a82 , < c554ddc87af4d4e4be42f8aed1baec9e1c7588e0 (git)
Affected: 89ac9b4d3d1a049ae1054f99b1aed81092cd0a82 , < 3ca80e3012c8be85b4f8d0d20eac8d3b17ff257e (git)
Affected: 89ac9b4d3d1a049ae1054f99b1aed81092cd0a82 , < 041acda6d9f96006703466449c10c9a69590c8b9 (git)
Affected: 89ac9b4d3d1a049ae1054f99b1aed81092cd0a82 , < d309d3308de658d87c42d97e044c89a226327526 (git)
Affected: 89ac9b4d3d1a049ae1054f99b1aed81092cd0a82 , < bfbcce6a7b0552a390620d9b2c4d2bcb1825cbdc (git)
Affected: 89ac9b4d3d1a049ae1054f99b1aed81092cd0a82 , < 90c500e4fd83fa33c09bc7ee23b6d9cc487ac733 (git)
Create a notification for this product.
Linux Linux Affected: 3.19
Unaffected: 0 , < 3.19 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.140 , ≤ 6.6.* (semver)
Unaffected: 6.12.88 , ≤ 6.12.* (semver)
Unaffected: 6.18.30 , ≤ 6.18.* (semver)
Unaffected: 7.0.7 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/hfsplus/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e890656accee4c26d932ea388eb8936a6e22184d",
              "status": "affected",
              "version": "89ac9b4d3d1a049ae1054f99b1aed81092cd0a82",
              "versionType": "git"
            },
            {
              "lessThan": "6499c9c8ec437a369e7e221dad91f6122b50759d",
              "status": "affected",
              "version": "89ac9b4d3d1a049ae1054f99b1aed81092cd0a82",
              "versionType": "git"
            },
            {
              "lessThan": "c554ddc87af4d4e4be42f8aed1baec9e1c7588e0",
              "status": "affected",
              "version": "89ac9b4d3d1a049ae1054f99b1aed81092cd0a82",
              "versionType": "git"
            },
            {
              "lessThan": "3ca80e3012c8be85b4f8d0d20eac8d3b17ff257e",
              "status": "affected",
              "version": "89ac9b4d3d1a049ae1054f99b1aed81092cd0a82",
              "versionType": "git"
            },
            {
              "lessThan": "041acda6d9f96006703466449c10c9a69590c8b9",
              "status": "affected",
              "version": "89ac9b4d3d1a049ae1054f99b1aed81092cd0a82",
              "versionType": "git"
            },
            {
              "lessThan": "d309d3308de658d87c42d97e044c89a226327526",
              "status": "affected",
              "version": "89ac9b4d3d1a049ae1054f99b1aed81092cd0a82",
              "versionType": "git"
            },
            {
              "lessThan": "bfbcce6a7b0552a390620d9b2c4d2bcb1825cbdc",
              "status": "affected",
              "version": "89ac9b4d3d1a049ae1054f99b1aed81092cd0a82",
              "versionType": "git"
            },
            {
              "lessThan": "90c500e4fd83fa33c09bc7ee23b6d9cc487ac733",
              "status": "affected",
              "version": "89ac9b4d3d1a049ae1054f99b1aed81092cd0a82",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/hfsplus/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix held lock freed on hfsplus_fill_super()\n\nhfsplus_fill_super() calls hfs_find_init() to initialize a search\nstructure, which acquires tree-\u003etree_lock. If the subsequent call to\nhfsplus_cat_build_key() fails, the function jumps to the out_put_root\nerror label without releasing the lock. The later cleanup path then\nfrees the tree data structure with the lock still held, triggering a\nheld lock freed warning.\n\nFix this by adding the missing hfs_find_exit(\u0026fd) call before jumping\nto the out_put_root error label. This ensures that tree-\u003etree_lock is\nproperly released on the error path.\n\nThe bug was originally detected on v6.13-rc1 using an experimental\nstatic analysis tool we are developing, and we have verified that the\nissue persists in the latest mainline kernel. The tool is specifically\ndesigned to detect memory management issues. It is currently under active\ndevelopment and not yet publicly available.\n\nWe confirmed the bug by runtime testing under QEMU with x86_64 defconfig,\nlockdep enabled, and CONFIG_HFSPLUS_FS=y. To trigger the error path, we\nused GDB to dynamically shrink the max_unistr_len parameter to 1 before\nhfsplus_asc2uni() is called. This forces hfsplus_asc2uni() to naturally\nreturn -ENAMETOOLONG, which propagates to hfsplus_cat_build_key() and\nexercises the faulty error path. The following warning was observed\nduring mount:\n\n\t=========================\n\tWARNING: held lock freed!\n\t7.0.0-rc3-00016-gb4f0dd314b39 #4 Not tainted\n\t-------------------------\n\tmount/174 is freeing memory ffff888103f92000-ffff888103f92fff, with a lock still held there!\n\tffff888103f920b0 (\u0026tree-\u003etree_lock){+.+.}-{4:4}, at: hfsplus_find_init+0x154/0x1e0\n\t2 locks held by mount/174:\n\t#0: ffff888103f960e0 (\u0026type-\u003es_umount_key#42/1){+.+.}-{4:4}, at: alloc_super.constprop.0+0x167/0xa40\n\t#1: ffff888103f920b0 (\u0026tree-\u003etree_lock){+.+.}-{4:4}, at: hfsplus_find_init+0x154/0x1e0\n\n\tstack backtrace:\n\tCPU: 2 UID: 0 PID: 174 Comm: mount Not tainted 7.0.0-rc3-00016-gb4f0dd314b39 #4 PREEMPT(lazy)\n\tHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\n\tCall Trace:\n\t\u003cTASK\u003e\n\tdump_stack_lvl+0x82/0xd0\n\tdebug_check_no_locks_freed+0x13a/0x180\n\tkfree+0x16b/0x510\n\t? hfsplus_fill_super+0xcb4/0x18a0\n\thfsplus_fill_super+0xcb4/0x18a0\n\t? __pfx_hfsplus_fill_super+0x10/0x10\n\t? srso_return_thunk+0x5/0x5f\n\t? bdev_open+0x65f/0xc30\n\t? srso_return_thunk+0x5/0x5f\n\t? pointer+0x4ce/0xbf0\n\t? trace_contention_end+0x11c/0x150\n\t? __pfx_pointer+0x10/0x10\n\t? srso_return_thunk+0x5/0x5f\n\t? bdev_open+0x79b/0xc30\n\t? srso_return_thunk+0x5/0x5f\n\t? srso_return_thunk+0x5/0x5f\n\t? vsnprintf+0x6da/0x1270\n\t? srso_return_thunk+0x5/0x5f\n\t? __mutex_unlock_slowpath+0x157/0x740\n\t? __pfx_vsnprintf+0x10/0x10\n\t? srso_return_thunk+0x5/0x5f\n\t? srso_return_thunk+0x5/0x5f\n\t? mark_held_locks+0x49/0x80\n\t? srso_return_thunk+0x5/0x5f\n\t? srso_return_thunk+0x5/0x5f\n\t? irqentry_exit+0x17b/0x5e0\n\t? trace_irq_disable.constprop.0+0x116/0x150\n\t? __pfx_hfsplus_fill_super+0x10/0x10\n\t? __pfx_hfsplus_fill_super+0x10/0x10\n\tget_tree_bdev_flags+0x302/0x580\n\t? __pfx_get_tree_bdev_flags+0x10/0x10\n\t? vfs_parse_fs_qstr+0x129/0x1a0\n\t? __pfx_vfs_parse_fs_qstr+0x3/0x10\n\tvfs_get_tree+0x89/0x320\n\tfc_mount+0x10/0x1d0\n\tpath_mount+0x5c5/0x21c0\n\t? __pfx_path_mount+0x10/0x10\n\t? trace_irq_enable.constprop.0+0x116/0x150\n\t? trace_irq_enable.constprop.0+0x116/0x150\n\t? srso_return_thunk+0x5/0x5f\n\t? srso_return_thunk+0x5/0x5f\n\t? kmem_cache_free+0x307/0x540\n\t? user_path_at+0x51/0x60\n\t? __x64_sys_mount+0x212/0x280\n\t? srso_return_thunk+0x5/0x5f\n\t__x64_sys_mount+0x212/0x280\n\t? __pfx___x64_sys_mount+0x10/0x10\n\t? srso_return_thunk+0x5/0x5f\n\t? trace_irq_enable.constprop.0+0x116/0x150\n\t? srso_return_thunk+0x5/0x5f\n\tdo_syscall_64+0x111/0x680\n\tentry_SYSCALL_64_after_hwframe+0x77/0x7f\n\tRIP: 0033:0x7ffacad55eae\n\tCode: 48 8b 0d 85 1f 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 8\n\tRSP: 002b\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is only reachable through the local mount syscall path (__x64_sys_mount \u2192 path_mount \u2192 vfs_get_tree \u2192 get_tree_bdev \u2192 hfsplus_fill_super); hfsplus is a block-device filesystem with no network-facing handler.\nAC:H - The faulty branch requires hfsplus_cat_build_key() to fail on the hardcoded HFSP_HIDDENDIR_NAME string (29 bytes, limit 255), which researchers could only trigger by GDB-patching max_unistr_len; attackers cannot influence this input via a crafted HFS+ image.\nPR:L - Exploitation requires mounting an hfsplus volume, which needs CAP_SYS_ADMIN; per kernel CNA guidance this is Low because unprivileged users with user-namespace CAP_SYS_ADMIN can mount loop-backed filesystems.\nUI:N - No victim interaction is required; the attacker (or their user-namespace root) initiates the mount syscall directly to reach the vulnerable cleanup path.\nS:U - Impact is confined to kernel memory/locking state during mount teardown; it does not cross a VM, container, or IOMMU security boundary.\nC:H - Freeing the hfs_btree structure while tree_lock is still held corrupts lock lifecycle state and can lead to use-after-free of the embedded mutex metadata when the slab is reused, enabling potential kernel memory disclosure.\nI:H - The held-lock-during-kfree condition is a memory-management corruption bug that can corrupt mutex/lockdep state and potentially be leveraged for further kernel memory writes or control-flow disruption.\nA:H - The confirmed runtime impact is a lockdep \"held lock freed\" warning during mount failure, and freeing kernel structures with active locks can cause kernel instability, oops, or panic on subsequent lock operations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:04.308Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e890656accee4c26d932ea388eb8936a6e22184d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6499c9c8ec437a369e7e221dad91f6122b50759d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c554ddc87af4d4e4be42f8aed1baec9e1c7588e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ca80e3012c8be85b4f8d0d20eac8d3b17ff257e"
        },
        {
          "url": "https://git.kernel.org/stable/c/041acda6d9f96006703466449c10c9a69590c8b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/d309d3308de658d87c42d97e044c89a226327526"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfbcce6a7b0552a390620d9b2c4d2bcb1825cbdc"
        },
        {
          "url": "https://git.kernel.org/stable/c/90c500e4fd83fa33c09bc7ee23b6d9cc487ac733"
        }
      ],
      "title": "hfsplus: fix held lock freed on hfsplus_fill_super()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46299",
    "datePublished": "2026-06-08T15:46:26.670Z",
    "dateReserved": "2026-05-13T15:03:33.111Z",
    "dateUpdated": "2026-08-05T12:31:04.308Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46299",
      "date": "2026-08-05",
      "epss": "0.00091",
      "percentile": "0.00571"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-17T14:45:34.000Z",
      "cve": "CVE-2026-46299",
      "id": "msrc_CVE-2026-46299",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "hfsplus: fix held lock freed on hfsplus_fill_super()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46299.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46299\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-08T17:16:48.393\",\"lastModified\":\"2026-07-08T14:48:53.510\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhfsplus: fix held lock freed on hfsplus_fill_super()\\n\\nhfsplus_fill_super() calls hfs_find_init() to initialize a search\\nstructure, which acquires tree-\u003etree_lock. If the subsequent call to\\nhfsplus_cat_build_key() fails, the function jumps to the out_put_root\\nerror label without releasing the lock. The later cleanup path then\\nfrees the tree data structure with the lock still held, triggering a\\nheld lock freed warning.\\n\\nFix this by adding the missing hfs_find_exit(\u0026fd) call before jumping\\nto the out_put_root error label. This ensures that tree-\u003etree_lock is\\nproperly released on the error path.\\n\\nThe bug was originally detected on v6.13-rc1 using an experimental\\nstatic analysis tool we are developing, and we have verified that the\\nissue persists in the latest mainline kernel. The tool is specifically\\ndesigned to detect memory management issues. It is currently under active\\ndevelopment and not yet publicly available.\\n\\nWe confirmed the bug by runtime testing under QEMU with x86_64 defconfig,\\nlockdep enabled, and CONFIG_HFSPLUS_FS=y. To trigger the error path, we\\nused GDB to dynamically shrink the max_unistr_len parameter to 1 before\\nhfsplus_asc2uni() is called. This forces hfsplus_asc2uni() to naturally\\nreturn -ENAMETOOLONG, which propagates to hfsplus_cat_build_key() and\\nexercises the faulty error path. The following warning was observed\\nduring mount:\\n\\n\\t=========================\\n\\tWARNING: held lock freed!\\n\\t7.0.0-rc3-00016-gb4f0dd314b39 #4 Not tainted\\n\\t-------------------------\\n\\tmount/174 is freeing memory ffff888103f92000-ffff888103f92fff, with a lock still held there!\\n\\tffff888103f920b0 (\u0026tree-\u003etree_lock){+.+.}-{4:4}, at: hfsplus_find_init+0x154/0x1e0\\n\\t2 locks held by mount/174:\\n\\t#0: ffff888103f960e0 (\u0026type-\u003es_umount_key#42/1){+.+.}-{4:4}, at: alloc_super.constprop.0+0x167/0xa40\\n\\t#1: ffff888103f920b0 (\u0026tree-\u003etree_lock){+.+.}-{4:4}, at: hfsplus_find_init+0x154/0x1e0\\n\\n\\tstack backtrace:\\n\\tCPU: 2 UID: 0 PID: 174 Comm: mount Not tainted 7.0.0-rc3-00016-gb4f0dd314b39 #4 PREEMPT(lazy)\\n\\tHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\\n\\tCall Trace:\\n\\t\u003cTASK\u003e\\n\\tdump_stack_lvl+0x82/0xd0\\n\\tdebug_check_no_locks_freed+0x13a/0x180\\n\\tkfree+0x16b/0x510\\n\\t? hfsplus_fill_super+0xcb4/0x18a0\\n\\thfsplus_fill_super+0xcb4/0x18a0\\n\\t? __pfx_hfsplus_fill_super+0x10/0x10\\n\\t? srso_return_thunk+0x5/0x5f\\n\\t? bdev_open+0x65f/0xc30\\n\\t? srso_return_thunk+0x5/0x5f\\n\\t? pointer+0x4ce/0xbf0\\n\\t? trace_contention_end+0x11c/0x150\\n\\t? __pfx_pointer+0x10/0x10\\n\\t? srso_return_thunk+0x5/0x5f\\n\\t? bdev_open+0x79b/0xc30\\n\\t? srso_return_thunk+0x5/0x5f\\n\\t? srso_return_thunk+0x5/0x5f\\n\\t? vsnprintf+0x6da/0x1270\\n\\t? srso_return_thunk+0x5/0x5f\\n\\t? __mutex_unlock_slowpath+0x157/0x740\\n\\t? __pfx_vsnprintf+0x10/0x10\\n\\t? srso_return_thunk+0x5/0x5f\\n\\t? srso_return_thunk+0x5/0x5f\\n\\t? mark_held_locks+0x49/0x80\\n\\t? srso_return_thunk+0x5/0x5f\\n\\t? srso_return_thunk+0x5/0x5f\\n\\t? irqentry_exit+0x17b/0x5e0\\n\\t? trace_irq_disable.constprop.0+0x116/0x150\\n\\t? __pfx_hfsplus_fill_super+0x10/0x10\\n\\t? __pfx_hfsplus_fill_super+0x10/0x10\\n\\tget_tree_bdev_flags+0x302/0x580\\n\\t? __pfx_get_tree_bdev_flags+0x10/0x10\\n\\t? vfs_parse_fs_qstr+0x129/0x1a0\\n\\t? __pfx_vfs_parse_fs_qstr+0x3/0x10\\n\\tvfs_get_tree+0x89/0x320\\n\\tfc_mount+0x10/0x1d0\\n\\tpath_mount+0x5c5/0x21c0\\n\\t? __pfx_path_mount+0x10/0x10\\n\\t? trace_irq_enable.constprop.0+0x116/0x150\\n\\t? trace_irq_enable.constprop.0+0x116/0x150\\n\\t? srso_return_thunk+0x5/0x5f\\n\\t? srso_return_thunk+0x5/0x5f\\n\\t? kmem_cache_free+0x307/0x540\\n\\t? user_path_at+0x51/0x60\\n\\t? __x64_sys_mount+0x212/0x280\\n\\t? srso_return_thunk+0x5/0x5f\\n\\t__x64_sys_mount+0x212/0x280\\n\\t? __pfx___x64_sys_mount+0x10/0x10\\n\\t? srso_return_thunk+0x5/0x5f\\n\\t? trace_irq_enable.constprop.0+0x116/0x150\\n\\t? srso_return_thunk+0x5/0x5f\\n\\tdo_syscall_64+0x111/0x680\\n\\tentry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\tRIP: 0033:0x7ffacad55eae\\n\\tCode: 48 8b 0d 85 1f 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 8\\n\\tRSP: 002b\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/hfsplus/super.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"89ac9b4d3d1a049ae1054f99b1aed81092cd0a82\",\"lessThan\":\"e890656accee4c26d932ea388eb8936a6e22184d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"89ac9b4d3d1a049ae1054f99b1aed81092cd0a82\",\"lessThan\":\"6499c9c8ec437a369e7e221dad91f6122b50759d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"89ac9b4d3d1a049ae1054f99b1aed81092cd0a82\",\"lessThan\":\"c554ddc87af4d4e4be42f8aed1baec9e1c7588e0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"89ac9b4d3d1a049ae1054f99b1aed81092cd0a82\",\"lessThan\":\"3ca80e3012c8be85b4f8d0d20eac8d3b17ff257e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"89ac9b4d3d1a049ae1054f99b1aed81092cd0a82\",\"lessThan\":\"041acda6d9f96006703466449c10c9a69590c8b9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"89ac9b4d3d1a049ae1054f99b1aed81092cd0a82\",\"lessThan\":\"d309d3308de658d87c42d97e044c89a226327526\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"89ac9b4d3d1a049ae1054f99b1aed81092cd0a82\",\"lessThan\":\"bfbcce6a7b0552a390620d9b2c4d2bcb1825cbdc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"89ac9b4d3d1a049ae1054f99b1aed81092cd0a82\",\"lessThan\":\"90c500e4fd83fa33c09bc7ee23b6d9cc487ac733\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/hfsplus/super.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.259\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.210\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.140\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.88\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.30\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.7\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.19\",\"versionEndExcluding\":\"5.10.259\",\"matchCriteriaId\":\"B7671B6F-58A3-4C86-AD1F-9A93A153C5C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.210\",\"matchCriteriaId\":\"5E938CDF-D1C4-43D0-98DC-9E11B6B55801\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.176\",\"matchCriteriaId\":\"C4446623-5F2B-4DD8-8666-9FAAC285A757\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.140\",\"matchCriteriaId\":\"A1A92866-F406-43B5-B2D1-CFC274753E9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.88\",\"matchCriteriaId\":\"5AFBE0EC-CCDF-4207-AE92-ABF958125CA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.30\",\"matchCriteriaId\":\"BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.7\",\"matchCriteriaId\":\"D0893CA7-9AE6-4DFE-AC75-48967D73AD8E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/041acda6d9f96006703466449c10c9a69590c8b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3ca80e3012c8be85b4f8d0d20eac8d3b17ff257e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6499c9c8ec437a369e7e221dad91f6122b50759d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/90c500e4fd83fa33c09bc7ee23b6d9cc487ac733\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bfbcce6a7b0552a390620d9b2c4d2bcb1825cbdc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c554ddc87af4d4e4be42f8aed1baec9e1c7588e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d309d3308de658d87c42d97e044c89a226327526\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e890656accee4c26d932ea388eb8936a6e22184d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-05T14:46:25+00:00",
      "cve": "CVE-2026-46299",
      "id": "CVE-2026-46299",
      "initial_release_date": "2026-06-08T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: hfsplus: fix held lock freed on hfsplus_fill_super()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46299.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:17:05Z",
      "cve": "CVE-2026-46299",
      "id": "CVE-2026-46299",
      "initial_release_date": "2026-06-09T02:20:49Z",
      "product_status:known_affected": "259",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "41",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46299",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46299.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.