---
cve: "CVE-2025-68774"
severity: "HIGH"
cvss: 7.5
epss: "51%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-01-13 16:15:56"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-12T07:34:21+02:00"
---

# CVE-2025-68774

> 7.5 HIGH

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create

When sync() and link() are called concurrently, both threads may
enter hfs_bnode_find() without finding the node in the hash table
and proceed to create it.

Thread A:
  hfsplus_write_inode()
    -> hfsplus_write_system_inode()
      -> hfs_btree_write()
        -> hfs_bnode_find(tree, 0)
          -> __hfs_bnode_create(tree, 0)

Thread B:
  hfsplus_create_cat()
    -> hfs_brec_insert()
      -> hfs_bnode_split()
        -> hfs_bmap_alloc()
          -> hfs_bnode_find(tree, 0)
            -> __hfs_bnode_create(tree, 0)

In this case, thread A creates the bnode, sets refcnt=1, and hashes it.
Thread B also tries to create the same bnode, notices it has already
been inserted, drops its own instance, and uses the hashed one without
getting the node.

```

	node2 = hfs_bnode_findhash(tree, cnid);
	if (!node2) {                                 next_hash = tree->node_hash[hash];
		tree->node_hash[hash] = node;
		tree->node_hash_cnt++;
	} else {                                      hash_lock);
		kfree(node);
		wait_event(node2->lock_wq,
			!test_bit(HFS_BNODE_NEW, &node2->flags));
		return node2;
	}
```

However, hfs_bnode_find() requires each call to take a reference.
Here both threads end up setting refcnt=1. When they later put the node,
this triggers:

BUG_ON(!atomic_read(&node->refcnt))

In this scenario, Thread B in fact finds the node in the hash table
rather than creating a new one, and thus must take a reference.

Fix this by calling hfs_bnode_get() when reusing a bnode newly created by
another thread to ensure the refcount is updated correctly.

A similar bug was fixed in HFS long ago in commit
a9dc087fd3c4 ("fix missing hfs_bnode_get() in __hfs_bnode_create")
but the same issue remained in HFS+ until now.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Keine | good |
| I Integrität | Keine | good |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- Kernel ≥ 5.10.248
- Kernel ≥ 5.15.198
- Kernel ≥ 6.1.160
- Kernel ≥ 6.6.120
- Kernel ≥ 6.12.64
- Kernel ≥ 6.18.3

## Referenzen

- <https://git.kernel.org/stable/c/3b0fc7af50b896d0f3d104e70787ba1973bc0b56>
- <https://git.kernel.org/stable/c/39e149d58ef4d7883cbf87448d39d51292fd342d>
- <https://git.kernel.org/stable/c/b68dc4134b18a3922cd33439ec614aad4172bc86>
- <https://git.kernel.org/stable/c/b9d1c6bb5f19460074ce9862cb80be86b5fb0a50>
- <https://git.kernel.org/stable/c/457f795e7abd7770de10216d7f9994a3f12a56d6>
- <https://git.kernel.org/stable/c/5882e7c8cdbb5e254a69628b780acff89c78071e>
- <https://git.kernel.org/stable/c/152af114287851583cf7e0abc10129941f19466a>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2025-68774) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_