Skip to main content

Linux Kernel EUVDEUVD-2026-27663

| CVE-2026-43268 MEDIUM
2026-05-06 Linux GHSA-9wc3-g8j8-wv5q
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privilege sufficient to mount HFS+ media; no confidentiality or integrity impact, only kernel panic availability loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:45 vuln.today
CVSS changed
May 08, 2026 - 21:07 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: pretend special inodes as regular files

Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()") requires any inode be one of S_IFDIR/S_IFLNK/S_IFREG/S_IFCHR/S_IFBLK/ S_IFIFO/S_IFSOCK type, use S_IFREG for special inodes.

AnalysisAI

Kernel crash in the Linux hfsplus filesystem driver results from a VFS enforcement change (commit af153bb63a33) that requires all inodes to carry a standard file-type mode bit, which hfsplus special inodes (catalog file, extents overflow file, attributes file, etc.) historically did not. Any local user able to trigger access to those special inodes on a mounted HFS+ volume can cause a kernel panic, producing a high-availability denial-of-service. No public exploit code exists and EPSS sits at 0.02% (7th percentile), reflecting low opportunistic exploitation likelihood, but the bug is deterministically reproducible against any unpatched kernel configured with hfsplus support.

Technical ContextAI

HFS+ (Hierarchical File System Plus) is Apple's legacy filesystem format, supported in the Linux kernel via the hfsplus driver. Internally, hfsplus maintains a set of 'special inodes' - fixed-purpose metadata files such as the catalog B-tree, extents overflow file, allocation bitmap, and attributes file - that are represented as VFS inodes but were not assigned any of the standard POSIX mode type bits (S_IFDIR, S_IFLNK, S_IFREG, etc.). Kernel commit af153bb63a33 ('vfs: catch invalid modes in may_open()') added an enforcement gate in the VFS may_open() path that rejects any inode whose mode does not carry one of those canonical type flags. Once that VFS hardening landed, accessing a mounted HFS+ volume would cause these untyped special inodes to fail the check, triggering a kernel-level error path (BUG/WARN/OOPS or panic). The fix reassigns these special inodes the S_IFREG type flag to satisfy the VFS constraint without changing their actual behaviour. CPE data identifies the affected platform as cpe:2.3:a:linux:linux and patched stable branches span 5.10.x through 7.0. No CWE is assigned, but the root cause class is improper inode type initialisation - a variant of incorrect resource characterisation.

RemediationAI

The primary fix is to upgrade to a patched stable kernel release: 5.10.252 or later in the 5.10 series, 5.15.202 or later in the 5.15 series, 6.1.165 or later in the 6.1 series, 6.6.128 or later in the 6.6 series, 6.12.75 or later in the 6.12 series, 6.18.16 or later in the 6.18 series, 6.19.6 or later in the 6.19 series, and 7.0 for the mainline series. Upstream fix commits are published at https://git.kernel.org/stable/c/. Ubuntu users should apply the update referenced in USN-8492-1 (https://ubuntu.com/security/notices/USN-8492-1). NVD detail is at https://nvd.nist.gov/vuln/detail/CVE-2026-43268. As a compensating control on systems that cannot be patched immediately, the hfsplus kernel module can be blocklisted by adding 'install hfsplus /bin/false' to /etc/modprobe.d/blocklist.conf and rebooting; this prevents HFS+ volumes from being mounted, eliminating the attack surface at the cost of losing HFS+ filesystem functionality. Systems that do not mount Apple HFS+ volumes are not exposed and require no additional action beyond routine kernel patching.

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27663 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy