HFS+ Thread Record Vulnerability in Linux Package: CVE-2026-93095
Summary
DEBIAN-CVE-2026-93095: In the Linux kernel, the following vulnerability has been resolved: hfsplus: validate thread record before delete key rebuild hfsplus_delete_cat() is called with str == NULL when the last open reference to an unlinked HF... Affects linux versions 6.1.106-1 – 7.2~rc7-1~exp1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interactions. It supports a wide range of functionalities, including file systems like HFS+, which is used primarily in Apple devices. This vulnerability affects the HFS+ file system implementation in the Linux kernel, specifically in how it handles thread records, which are crucial for managing file metadata.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the handling of HFS+ thread records. The function hfsplus_delete_cat() can be called with a NULL string when the last reference to an unlinked HFS+ hardlink backing inode is closed. This leads to a situation where the catalog thread is found by CNID, and the catalog key is reconstructed from thread.nodeName without proper validation. If a corrupted image provides an oversized thread name length, it can cause hfs_bnode_read() to write beyond the allocated memory for the catalog search-key. This can lead to memory corruption and potential exploitation by attackers.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using HFS+ file systems with unlinked hardlinks until the package is updated. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The CVE-2026-93095 vulnerability in the Linux kernel's HFS+ file system poses significant risks due to improper handling of thread records. It is crucial to update the affected packages to mitigate these risks and ensure system integrity. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2026-93095 is a vulnerability in the Linux kernel's HFS+ file system that can lead to memory corruption due to improper handling of thread records.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to memory corruption, which may allow attackers to execute arbitrary code or crash the system.
Yes, a patch is available. It is recommended to update the Linux package to the latest version that includes the fix.
If you cannot update your system, avoid using HFS+ file systems with unlinked hardlinks as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
