CVE-2026-43268

Root

Cause

In the HFS+ filesystem implementation in the Linux kernel, certain special inodes (e.g., those representing metadata or attributes) were not assigned a valid file type such as S_IFREG, S_IFDIR, or S_IFLNK. Since commit af153bb63a33 ("vfs: catch invalid modes in may_open()"), the kernel enforces that every inode passed to may_open() must have a recognized mode. Attempting to open these special inodes triggered a failure because their mode was not one of the allowed types [1][2][3][4].

Exploitation

An attacker with local access to a system using the HFS+ filesystem could trigger this vulnerability by opening a special inode (e.g., via standard file operations on metadata files or by mounting a crafted HFS+ image). No special privileges beyond the ability to interact with the filesystem are required; the bug manifests as a denial of service (e.g., failure to open files, system call errors) or potentially a system crash if the unexpected mode is not handled gracefully [1][3].

Impact

The primary impact is denial of service. Because may_open() rejects the inode, any attempt to open, read, or write the affected special inode returns an error, making the filesystem partially unavailable. In some configurations, this could lead to a system hang or panic if the VFS layer encounters the invalid mode. The CVSS v3 score of 5.5 (Medium) reflects this availability impact with a local attack vector and low complexity [1][2][4].

Mitigation

The fix introduced in kernel commits replaces the invalid modes of such special inodes with S_IFREG, ensuring they pass the may_open() check. The patch has been backported to stable kernel branches and is included in updates. Users should apply the latest kernel updates from their distribution. No workaround exists other than avoiding the use of HFS+ filesystems or not mounting untrusted HFS+ images until the patched kernel is deployed [1][2][3][4].