CVE-2026-46299

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.12-1.1

Description An issue exists in the hfsplus file system where the hfsplus fill super() function calls hfs find init() to initialize a search structure, which acquires tree->tree lock. If a subsequent call to hfsplus cat build key() fails, the function jumps to the out put root error label without releasing the lock. This results in the tree data structure being freed while the lock is still held, triggering a held lock freed warning.

Recommendations Update to version 7.0.12-1.1 or later.