CVE-2023-53862: hfs: fix missing hfs_bnode_get() in __hfs_bnode_create

Published Dec 9, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

hfs: fix missing hfsbnodeget() in hfsbnodecreate

Syzbot found a kernel BUG in hfsbnodeput():

kernel BUG at fs/hfs/bnode.c:466! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 3634 Comm: kworker/u4:5 Not tainted 6.1.0-rc7-syzkaller-00190-g97ee9d1c1696 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: writeback wbworkfn (flush-7:0) RIP: 0010:hfsbnodeput+0x46f/0x480 fs/hfs/bnode.c:466 Code: 8a 80 ff e9 73 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a0 fe ff ff 48 89 df e8 db 8a 80 ff e9 93 fe ff ff e8 a1 68 2c ff <0f> 0b e8 9a 68 2c ff 0f 0b 0f 1f 84 00 00 00 00 00 55 41 57 41 56 RSP: 0018:ffffc90003b4f258 EFLAGS: 00010293 RAX: ffffffff825e318f RBX: 0000000000000000 RCX: ffff8880739dd7c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003b4f430 R08: ffffffff825e2d9b R09: ffffed10045157d1 R10: ffffed10045157d1 R11: 1ffff110045157d0 R12: ffff8880228abe80 R13: ffff88807016c000 R14: dffffc0000000000 R15: ffff8880228abe00 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa6ebe88718 CR3: 000000001e93d000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> hfswriteinode+0x1bc/0xb40 writeinode fs/fs-writeback.c:1440 [inline] writebacksingleinode+0x4d6/0x670 fs/fs-writeback.c:1652 writebacksbinodes+0xb3b/0x18f0 fs/fs-writeback.c:1878 writebackinodeswb+0x125/0x420 fs/fs-writeback.c:1949 wbwriteback+0x440/0x7b0 fs/fs-writeback.c:2054 wbcheckstartall fs/fs-writeback.c:2176 [inline] wbdowriteback fs/fs-writeback.c:2202 [inline] wbworkfn+0x827/0xef0 fs/fs-writeback.c:2235 processonework+0x877/0xdb0 kernel/workqueue.c:2289 workerthread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376 retfromfork+0x1f/0x30 arch/x86/entry/entry64.S:306 </TASK>

The BUGON() is triggered at here:

/ Dispose of resources used by a node / void hfsbnodeput(struct hfsbnode node) { if (node) { <skipped> BUGON(!atomicread(&node->refcnt)); <- we have issue here!!!! <skipped> } }

By tracing the refcnt, I found the node is created by hfsbmapalloc() with refcnt 1. Then the node is used by hfsbtreewrite(). There is a missing of hfsbnodeget() after find the node. The issue happened in following path:

<alloc> hfsbmapalloc hfsbnodefind hfsbnodecreate <- allocate a new node with refcnt 1. hfsbnodeput <- decrease the refcnt

<write> hfsbtreewrite hfsbnodefind hfsbnodecreate hfsbnodefindhash <- find the node without refcnt increased. hfsbnodeput <- trigger the BUGON() since refcnt is 0.

Affected Software

172 affected componentsFixes available
linux/kernel
ubuntu/linux*
ubuntu/linux-aws*
ubuntu/linux-azure*
ubuntu/linux-lts-xenial*
ubuntu/linux*
ubuntu/linux-aws*
ubuntu/linux-aws-hwe*
ubuntu/linux-azure*
ubuntu/linux-gcp*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-kvm*
ubuntu/linux-oracle*
ubuntu/linux-fips*
ubuntu/linux-fips*
ubuntu/linux*
ubuntu/linux-aws*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-aws-5.4<5.4.0-1104.112~18.04.1
5.4.0-1104.112~18.04.1
ubuntu/linux-azure*
ubuntu/linux-azure-4.15*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-5.4<5.4.0-1110.116~18.04.1
5.4.0-1110.116~18.04.1
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-4.15*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gcp-5.4<5.4.0-1107.116~18.04.1
5.4.0-1107.116~18.04.1
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-5.4<5.4.0-152.169~18.04.1
5.4.0-152.169~18.04.1
ubuntu/linux-hwe-edge*
ubuntu/linux-ibm-5.4<5.4.0-1051.56~18.04.1
5.4.0-1051.56~18.04.1
ubuntu/linux-kvm*
ubuntu/linux-oem*
ubuntu/linux-oracle*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-oracle-5.4<5.4.0-1103.112~18.04.1
5.4.0-1103.112~18.04.1
ubuntu/linux-raspi-5.4<5.4.0-1088.99~18.04.1
5.4.0-1088.99~18.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.4.0-152.169
5.4.0-152.169
ubuntu/linux-aws<5.4.0-1104.112
5.4.0-1104.112
ubuntu/linux-aws-5.15<5.15.0-1038.43~20.04.1
5.15.0-1038.43~20.04.1
ubuntu/linux-azure<5.4.0-1110.116
5.4.0-1110.116
ubuntu/linux-azure-5.15<5.15.0-1040.47~20.04.1
5.15.0-1040.47~20.04.1
ubuntu/linux-bluefield<5.4.0-1065.71
5.4.0-1065.71
ubuntu/linux-gcp<5.4.0-1107.116
5.4.0-1107.116
ubuntu/linux-gcp-5.15<5.15.0-1036.44~20.04.1
5.15.0-1036.44~20.04.1
ubuntu/linux-hwe-5.15<5.15.0-75.82~20.04.1
5.15.0-75.82~20.04.1
ubuntu/linux-ibm<5.4.0-1051.56
5.4.0-1051.56
ubuntu/linux-intel-iotg-5.15<5.15.0-1033.38~20.04.1
5.15.0-1033.38~20.04.1
ubuntu/linux-iot<5.4.0-1017.18
5.4.0-1017.18
ubuntu/linux-kvm<5.4.0-1093.99
5.4.0-1093.99
ubuntu/linux-lowlatency-hwe-5.15<5.15.0-75.82~20.04.1
5.15.0-75.82~20.04.1
ubuntu/linux-nvidia-tegra-5.15<5.15.0-1015.15~20.04.1
5.15.0-1015.15~20.04.1
ubuntu/linux-oracle<5.4.0-1103.112
5.4.0-1103.112
ubuntu/linux-oracle-5.15<5.15.0-1037.43~20.04.1
5.15.0-1037.43~20.04.1
ubuntu/linux-raspi<5.4.0-1088.99
5.4.0-1088.99
ubuntu/linux-riscv-5.15<5.15.0-1035.39~20.04.1
5.15.0-1035.39~20.04.1
ubuntu/linux-xilinx-zynqmp<5.4.0-1024.28
5.4.0-1024.28
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-aws-fips<5.4.0-1104.112+fips1
5.4.0-1104.112+fips1
ubuntu/linux-azure-fips<5.4.0-1110.116+fips1
5.4.0-1110.116+fips1
ubuntu/linux-fips<5.4.0-1079.88
5.4.0-1079.88
ubuntu/linux-gcp-fips<5.4.0-1107.116+fips1
5.4.0-1107.116+fips1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.15.0-75.82
5.15.0-75.82
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws<5.15.0-1038.43
5.15.0-1038.43
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-azure<5.15.0-1040.47
5.15.0-1040.47
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-fde<5.15.0-1041.48.1
5.15.0-1041.48.1
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-gcp<5.15.0-1036.44
5.15.0-1036.44
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gke<5.15.0-1036.41
5.15.0-1036.41
ubuntu/linux-gkeop<5.15.0-1022.27
5.15.0-1022.27
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-ibm<5.15.0-1032.35
5.15.0-1032.35
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-intel-iotg<5.15.0-1033.38
5.15.0-1033.38
ubuntu/linux-kvm<5.15.0-1035.40
5.15.0-1035.40
ubuntu/linux-lowlatency<5.15.0-75.82
5.15.0-75.82
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-nvidia<5.15.0-1027.27
5.15.0-1027.27
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-tegra<5.15.0-1015.15
5.15.0-1015.15
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle<5.15.0-1037.43
5.15.0-1037.43
ubuntu/linux-oracle-6.5*
ubuntu/linux-raspi<5.15.0-1032.35
5.15.0-1032.35
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-bluefield<5.15.0-1019.21
5.15.0-1019.21
ubuntu/linux-intel-iot-realtime<5.15.0-1033.35
5.15.0-1033.35
ubuntu/linux-realtime<5.15.0-1040.45
5.15.0-1040.45
ubuntu/linux-fips*
ubuntu/linux-azure-6.11*
ubuntu/linux-gcp-6.11*
ubuntu/linux-hwe-6.11*
ubuntu/linux-lowlatency-hwe-6.11*
ubuntu/linux-nvidia-6.11*
ubuntu/linux-oem-6.11*
ubuntu/linux-oem-6.8*
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-6.14*
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1104.112~18.04.1
  2. Upgrade

    Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1110.116~18.04.1
  3. Upgrade

    Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1107.116~18.04.1
  4. Upgrade

    Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-152.169~18.04.1
  5. Upgrade

    Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1051.56~18.04.1
  6. Upgrade

    Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1103.112~18.04.1
  7. Upgrade

    Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1088.99~18.04.1
  8. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.4.0-152.169
  9. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.4.0-1104.112
  10. Upgrade

    Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1038.43~20.04.1
  11. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.4.0-1110.116
  12. Upgrade

    Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1040.47~20.04.1
  13. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.4.0-1065.71
  14. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1107.116
  15. Upgrade

    Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1036.44~20.04.1
  16. Upgrade

    Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-75.82~20.04.1
  17. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1051.56
  18. Upgrade

    Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1033.38~20.04.1
  19. Upgrade

    Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.

    Fixed in 5.4.0-1017.18
  20. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1093.99
  21. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-75.82~20.04.1
  22. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1015.15~20.04.1
  23. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.4.0-1103.112
  24. Upgrade

    Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1037.43~20.04.1
  25. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.4.0-1088.99
  26. Upgrade

    Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1035.39~20.04.1
  27. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1024.28
  28. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1104.112+fips1
  29. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1110.116+fips1
  30. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1079.88
  31. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1107.116+fips1
  32. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.15.0-75.82
  33. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.15.0-1038.43
  34. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.15.0-1040.47
  35. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 5.15.0-1041.48.1
  36. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1036.44
  37. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.15.0-1036.41
  38. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.15.0-1022.27
  39. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1032.35
  40. Upgrade

    Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.

    Fixed in 5.15.0-1033.38
  41. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1035.40
  42. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 5.15.0-75.82
  43. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 5.15.0-1027.27
  44. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 5.15.0-1015.15
  45. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.15.0-1037.43
  46. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.15.0-1032.35
  47. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.15.0-1019.21
  48. Upgrade

    Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1033.35
  49. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1040.45

Event History

Dec 9, 2025
CVE Published
via MITRE·01:30 AM
Data Sourced
via MITRE·01:30 AM
DescriptionSeverity
Data Sourced
via OSV·04:17 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·04:17 PM
DescriptionSeverity

Frequently Asked Questions

1

What is the severity of CVE-2023-53862?

CVE-2023-53862 has been rated as a potentially high-severity vulnerability affecting the Linux kernel.

2

How do I fix CVE-2023-53862?

To fix CVE-2023-53862, update your Linux kernel to the latest version that contains the patches for this vulnerability.

3

What components are affected by CVE-2023-53862?

CVE-2023-53862 specifically affects the HFS filesystem implementation in the Linux kernel.

4

What are the potential impacts of CVE-2023-53862?

Exploitation of CVE-2023-53862 may lead to kernel crashes or unexpected behavior due to invalid opcode handling.

5

Who discovered CVE-2023-53862?

CVE-2023-53862 was identified by the Syzbot automated testing tool, which monitors for kernel bugs.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203