Linux Kernel EUVD-2026-27787

The vulnerability resides in the Linux kernel's HFS (Hierarchical File System) driver, a legacy Apple filesystem implementation. Commit a06ec283e125 expanded next_id, folder_count, and file_count fields in the superblock info structure to 64-bit integers and introduced BUG_ON macros to detect overflow conditions. BUG_ON is a kernel debugging mechanism that triggers a kernel panic when its condition evaluates to true - unlike graceful error returns, it halts the system. CWE-617 (Reachable Assertion) precisely describes this root cause: an assertion meant for development-time overflow detection remains reachable at runtime through attacker-controlled input (a corrupted MDB). The MDB (Master Directory Block) is the HFS filesystem metadata structure analogous to a superblock; if it contains malformed CNID counts, the BUG_ON fires before any bounds check returns an error code. The fix in commits b6536c1ced31 and b226804532a8 replaces the BUG_ON calls with proper conditional error handling that returns gracefully. CPE: cpe:2.3:a:linux:linux. Note that the VulDB tag 'Buffer Overflow' appears to be a mislabel - the root cause is a reachable assertion (CWE-617), not a memory buffer overflow.