CVE-2026-93095

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the hfsplus module where the hfsplus delete cat() function fails to validate a thread record before rebuilding a delete key. When the last open reference to an unlinked HFS+ hardlink backing inode is closed, the function reconstructs the catalog key using thread.nodeName.length from the catalog B-tree. Because the function does not verify if the record is a thread record or if its size matches the thread name, a corrupted image can provide an oversized length. This leads to a buffer overflow where hfs bnode read() writes beyond the catalog search-key allocation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.