Technical impact
A flaw in the Linux kernel’s HFS+ filesystem module causes a memory leak when a superblock is allocated but subsequent initialization fails. The kernel fails to free the filesystem‑specific data structure sb->s_fs_info, leaving it allocated and unwieldy. Repeated failures of mounting an HFS+ filesystem with the new mount API can therefore accumulate unused memory, which may ultimately exhaust system memory and degrade or halt kernel scheduling, resulting in a denial of service. The weakness is represented by CWE‑763 (Resource Leak).
Affected Systems
The vulnerability affects all Linux kernel builds that include the default HFS+ filesystem module. No specific kernel version is specified, so any kernel running a version that has not yet been patched to free sb->s_fs_info during superblock cleanup is potentially impacted. This includes common vendor distributions that ship their own kernel copies.
Risk and Exploitability
The CVSS score of 5.5 indicates medium severity. The EPSS score of 0.00022 indicates a very low probability of exploitation, and the issue is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is local privileged, requiring the attacker to execute a mount operation for an HFS+ filesystem using the new API. The vulnerability can be triggered by failed mount attempts, which could arise from malicious software purposely causing such failures or from automatic mounting of removable media with corrupted or unsupported HFS+ partitions. The exploit conditions do not require network access or remote code execution, but repeated failures can lead to resource exhaustion and service degradation.
