Riskcovery

CVE-2026-74414

hfsplus: Remove the duplicate attr inode dirty marking action

State
Published
Severity
Not scored
Published
Aug 15, 2026
Updated
Aug 17, 2026
Reserved
Aug 15, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: Remove the duplicate attr inode dirty marking action

Syzbot reported a null-ptr-deref in [1]. If the attributes file is not loaded during system mount, a trigger occurs [1] when setxattr is executed in userspace.

Remove the first mark attr inode dirty operation.

[1] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] Call Trace: hfsplus_setxattr+0x124/0x340 fs/hfsplus/xattr.c:555 hfsplus_trusted_setxattr+0x40/0x60 fs/hfsplus/xattr_trusted.c:30 __vfs_setxattr+0x43c/0x480 fs/xattr.c:218 __vfs_setxattr_noperm+0x12d/0x660 fs/xattr.c:252 vfs_setxattr+0x163/0x360 fs/xattr.c:339 do_setxattr fs/xattr.c:654 [inline]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ee8422d00b7cfa028823ebf1f28bf9dea428cac3 to before b3c7ccb1a93cbb5a9a13196abf608ffa2516817eAffected
  • ee8422d00b7cfa028823ebf1f28bf9dea428cac3 to before 7a41fd2b32e5908f19a68732008d581c167279ddAffected
LinuxLinux
  • 7.1Affected
  • before 7.1Not affected
  • 7.1.5 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.