SECUFOCUSNOW
Home›CVE index›CVE-2025-68774
Review reviewHigh

CVE-2025-68774

Linux

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create When sync() and link() are called concurrently, both threads may enter hfs_bnode_find() without finding the node in the hash table and proceed to create it. Thread A: hfsplus_write_inode() -> hfsplus_write_system_inode() -> hfs_btree_write() -> hfs_bnode_find(tree, 0) -> __hfs_bnode_create(tree, 0) Thread B: hfsplus_create_cat() -> hfs_brec_insert() -> hfs_bnode_split() -> hfs_bmap_alloc() -> hfs_bnode_find(tree, 0) -> __hfs_bnode_create(tree, 0) In this case, threa...

CVSS
7.5
EPSS
0.49%
39.5% percentile
CISA KEV
Not listed
Published
2026.01.14
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.49%
Technical severityCVSS 7.5

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create When sync() and link() are called concurrently, both threads may enter hfs_bnode_find() without finding the node in the hash table and proceed to create it. Thread A: hfsplus_write_inode() -> hfsplus_write_system_inode() -> hfs_btree_write() -> hfs_bnode_find(tree, 0) -> __hfs_bnode_create(tree, 0) Thread B: hfsplus_create_cat() -> hfs_brec_insert() -> hfs_bnode_split() -> hfs_bmap_alloc() -> hfs_bnode_find(tree, 0) -> __hfs_bnode_create(tree, 0) In this case, threa...

Affected product and versions

Product
Linux
Affected versions
>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 3b0fc7af50b896d0f3d104e70787ba1973bc0b56, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 39e149d58ef4d7883cbf87448d39d51292fd342d, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b68dc4134b18a3922cd33439ec614aad4172bc86, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b9d1c6bb5f19460074ce9862cb80be86b5fb0a50, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 457f795e7abd7770de10216d7f9994a3f12a56d6, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5882e7c8cdbb5e254a69628b780acff89c78071e, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 152af114287851583cf7e0abc10129941f19466a, >= 2.6.12
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
Not available
CVE-2025-68774 — Linux | SECUFOCUS NOW