CVE-2026-93095 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users who process HFS+ images should assess their exposure to this vulnerability and apply patches or mitigations as needed. This includes verifying Linux kernel versions and HFS+ image validation mechanisms to prevent potential buffer overflows, assessing the risk of arbitrary code execution or denial of service due to exploitation of this vulnerability, and prioritizing patching and mitigation efforts based on

Why it matters

This vulnerability in the Linux kernel's hfsplus_delete_cat() function can lead to a buffer overflow when handling corrupted HFS+ catalog B-trees, potentially allowing for arbitrary code execution or denial of service. Linux kernel developers, administrators, and users who process HFS+ images should assess their exposure and apply patches or mitigations as needed.

• Verify Linux kernel versions and HFS+ image validation mechanisms to prevent potential buffer overflows.
• Assess the risk of arbitrary code execution or denial of service due to exploitation of this vulnerability.
• Prioritize patching and mitigation efforts based on the severity of the vulnerability and potential impact on Linux kernel-based systems.

Technical summary

The hfsplus_delete_cat() function in the Linux kernel does not properly validate thread records when rebuilding the catalog key, leading to a potential buffer overflow. This vulnerability can be exploited by providing a corrupted HFS+ image. The function attempts to rebuild the catalog key from a thread record without properly validating the record's size, which can cause a buffer overflow when handling corrupted HFS+ catalog B-trees. Linux kernel developers, administrators, and users who process HFS+ images should assess their exposure and apply patches or mitigations as needed.

Defensive priority

High

Recommended defensive actions

• Review and apply the relevant Linux kernel patches to ensure the hfsplus_delete_cat() function properly validates thread records.
• Restrict access to untrusted HFS+ images and validate their integrity before mounting or processing.
• Monitor Linux kernel updates and security advisories for potential vulnerabilities and apply patches promptly.
• Verify Linux kernel versions and HFS+ image validation mechanisms to prevent potential buffer overflows.
• Assess the risk of arbitrary code execution or denial of service due to exploitation of this vulnerability.
• Prioritize patching and mitigation efforts based on the severity of the vulnerability and potential impact on Linux kernel-based systems.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was resolved in the Linux kernel through a series of commits that validate the thread record before deleting the key and rebuilding the catalog. The fix involves reading the CNID record through hfsplus_brec_read_cat(), which bounds the record read and verifies that a thread record's size exactly matches nodeName.length.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.