In the Linux kernel’s HFS+ file‑system implementation, the hfs_bnode_create function can erroneously return an existing node without increasing its reference count. When that node is later released, the kernel detects that its reference counter has dropped to zero and triggers a BUG, causing a kernel panic. This results in a loss of availability for the affected system. The flaw is an error‑handling defect that forces a crash rather than exposing data or permitting code execution.

All Linux kernel versions that include the HFS+ driver and are capable of mounting or manipulating HFS+ volumes are affected. The vulnerability manifests when hfs_bmap_alloc attempts to create a node that is already present in the hash table—an error condition that can arise from filesystem corruption or a faulty allocation request. Systems using older kernel releases that have not incorporated the fix are susceptible.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of <1% reflects a very low but non‑zero predicted exploitation likelihood, and the vulnerability is not listed in CISA’s KEV catalog. An attacker would need either local access to a running system with an HFS+ mount or the capability to supply a corrupted HFS+ volume to trigger the fault. While no widespread exploitation has been observed, the kernel panic can be leveraged for denial‑of‑service attacks in environments where HFS+ is in use.