The flaw occurs while the Linux kernel mounts an HFS+ filesystem. A corrupted node_size value of 1 in the catalog tree causes the offset calculation in the hfs_bnode_find() routine to be excessively large. As a result, the function fails to initialize the offset variable, producing an uninitialized value that propagates into the filesystem code. This improper initialization can lead to abnormal kernel behavior such as a crash, causing a denial of service by disrupting the system’s operating state.

All Linux kernel builds that include the hfsplus driver and have not incorporated the sanity check introduced by the referenced commits (e.g., 306265eb9 or 3f95e2662) are impacted. The vendor is Linux, product Linux kernel. Specific kernel versions are not enumerated in the record; the vulnerability applies to any build compiled with older hfsplus support prior to the patch commits.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% shows a very low probability of active exploitation. The vulnerability is not yet listed in CISA’s KEV catalog. Exploitation would require the ability to mount a crafted HFS+ image, which typically needs local privileged access (root or CAP_SYS_ADMIN) or administrative control over mounting operations. The likely attack vector is a local‑privileged user mounting a malformed filesystem image that triggers the uninitialized value bug and potentially corrupts kernel state or causes a crash.