The vulnerability lies in the Linux kernel's HFS+ filesystem handler: when a node that should be created already exists in the hash table, the function returns the existing node without increasing its reference count. Later, when the node is freed, the kernel detects an empty reference count and triggers a BUG, causing a kernel panic. This flaw results in a complete loss of system availability for the affected machine. The flaw does not provide direct code execution or information disclosure but can be leveraged to crash the host.

Any Linux system using the mainstream kernel that mounts or manipulates an HFS+ file system is affected. The problem arises when hfs_bmap_alloc() attempts to allocate a node that is already in use or when the file system is corrupted. The fix is available in recent kernel releases where hfs_bnode_create() returns an error pointer (ERR_PTR(-EEXIST)) instead of the stale node.

The fault is not listed in the CISA KEV catalog and its EPSS score is not available, indicating no known widespread exploitation. Attackers would need to cause or deliver a corrupted HFS+ volume, or have local access to manipulate the file system to trigger the error path. The impact is a denial of service through kernel panic, and the risk is moderate until a patch is applied. Until the fix is deployed, systems with mounted HFS+ file systems should consider disabling the driver or moving resources away from the affected partitions.