Linux Kernel CVE-2026-93095

Requires mounting an attacker-crafted/corrupted HFS+ filesystem image containing a catalog thread record with an oversized nodeName.length. The vulnerable reconstruction path is reached only via hfsplus_delete_cat() called with str==NULL - i.e. when the last open reference to an unlinked HFS+ hardlink backing inode is closed - so the attacker must both mount the image and trigger the unlinked-hardlink cleanup path. Exploitation is LIMITED by the need for local access to introduce and mount the image (normally CAP_SYS_ADMIN, or an unprivileged automount/udisks configuration), the CONFIG_HFSPLUS_FS module being loaded, and no network vector (AV:L). It is not exploitable against default configurations without an untrusted image being mounted.

The vendor-assigned CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) overstates real-world risk for this bug. The described flaw is an out-of-bounds write triggered only when a maliciously CRAFTED HFS+ image is mounted and a specific code path runs - hfsplus_delete_cat() is invoked with str==NULL when the last open reference to an unlinked HFS+ hardlink backing inode is closed, at which point an oversized thread.nodeName.length lets hfs_bnode_read() write past the catalog search-key allocation. This is a memory-corruption/DoS primitive (CWE-787 class, heap OOB write), not a confidentiality leak, so the C:H/I:H rating and the input 'Information Disclosure' tag are both inaccurate. There is no EPSS score, no CISA KEV listing, and no public exploit in the provided data - no public exploit identified at time of analysis. Realistic access is gated by the ability to get a crafted filesystem image mounted (crafted-image attack surface, typically CAP_SYS_ADMIN or an automount/udisks path), which is materially harder than AC:L implies. Net: a real but low-to-moderate priority hardening fix for a niche filesystem, not an urgent widely-exploitable flaw. Note: CWE is listed as N/A in the input despite the description clearly describing an OOB write - verify classification with vendor.

An attacker crafts a malicious HFS+ filesystem image whose catalog B-tree contains a thread-type record with an oversized nodeName.length, then gets a victim to mount it (e.g. USB insertion with automount, or an admin mounting an untrusted image). When the last open reference to an unlinked hardlink backing inode is closed, hfsplus_delete_cat() rebuilds the delete key from the unvalidated thread name and hfs_bnode_read() writes past the search-key allocation, corrupting kernel memory and typically crashing the system. No public exploit code is available.