The Linux kernel’s HFS filesystem contains an integer overflow flaw that triggers when the master directory block of a mounted filesystem becomes corrupted. The overflow occurs in 64‑bit counters for file and folder counts, and the old implementation used a BUG_ON to terminate the kernel when the counters exceeded their limits. The new patch replaces that BUG_ON with graceful error handling, preventing the crash. The weakness is an integer overflow, classified as CWE‑617.

Any Linux kernel build that includes HFS support but has not incorporated the two referenced commits is susceptible. No explicit version numbers are given in the CVE, so all kernels implementing HFS prior to the patches are considered vulnerable. The vulnerability applies to the general Linux kernel family across vendors.

The CVSS score for this issue is 5.5 and the EPSS score is less than 1%, indicating a relatively low likelihood of exploitation. It is not featured in the CISA KEV catalog. Attackers could attempt to trigger the bug by a corrupted HFS image; the pathway to exploitation is inferred from the description of the BUG_ON being triggered by an MDB corruption. Depending on the environment, this could be done with local access to mount a malformed filesystem or remotely if the host accepts external disk images. The resulting kernel panic leads to a denial‑of‑service condition that renders the affected machine unusable until reboot.