# CVE-2025-68774: hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create

CVE-2025-68774 is fixed in linux on 1 platform, first by DEBIAN-CVE-2025-68774, released January 13, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2025-68774
- Priority: High
- CVSS: 7.5 (Moderate)
- EPSS: 0.0059
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jan 13, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-68774

## Description

In the Linux kernel, the following vulnerability has been resolved:  hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create  When sync() and link() are called concurrently, both threads may enter hfs_bnode_find() without finding the node in the hash table and proceed to create it.  Thread A:   hfsplus_write_inode()     -> hfsplus_write_system_inode()       -> hfs_btree_write()         -> hfs_bnode_find(tree, 0)           -> __hfs_bnode_create(tree, 0)  Thread B:   hfsplus_create_cat()     -> hfs_brec_insert()       -> hfs_bnode_split()         -> hfs_bmap_alloc()           -> hfs_bnode_find(tree, 0)             -> __hfs_bnode_create(tree, 0)  In this case, thread A creates the bnode, sets refcnt=1, and hashes it. Thread B also tries to create the same bnode, notices it has already been inserted, drops its own instance, and uses the hashed one without getting the node.  ```  	node2 = hfs_bnode_findhash(tree, cnid); 	if (!node2) {                                 <- Thread A 		hash = hfs_bnode_hash(cnid); 		node->next_hash = tree->node_hash[hash]; 		tree->node_hash[hash] = node; 		tree->node_hash_cnt++; 	} else {                                      <- Thread B 		spin_unlock(&tree->hash_lock); 		kfree(node); 		wait_event(node2->lock_wq, 			!test_bit(HFS_BNODE_NEW, &node2->flags)); 		return node2; 	} ```  However, hfs_bnode_find() requires each call to take a reference. Here both threads end up setting refcnt=1. When they later put the node, this triggers:  BUG_ON(!atomic_read(&node->refcnt))  In this scenario, Thread B in fact finds the node in the hash table rather than creating a new one, and thus must take a reference.  Fix this by calling hfs_bnode_get() when reusing a bnode newly created by another thread to ensure the refcount is updated correctly.  A similar bug was fixed in HFS long ago in commit a9dc087fd3c4 ("fix missing hfs_bnode_get() in __hfs_bnode_create") but the same issue remained in HFS+ until now.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.162-1 | [DEBIAN-CVE-2025-68774](https://patchblox.com/security/data/fix/linux/debian-cve-2025-68774.md) | Jan 13, 2026 |
| Linux | linux Debian 13.5 (trixie) | 6.12.69-1 | [DEBIAN-CVE-2025-68774](https://patchblox.com/security/data/fix/linux/debian-cve-2025-68774.md) | Jan 13, 2026 |
| Linux | linux Debian 14 | 6.18.3-1 | [DEBIAN-CVE-2025-68774](https://patchblox.com/security/data/fix/linux/debian-cve-2025-68774.md) | Jan 13, 2026 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.