CVE-2026-46299: hfsplus: fix held lock freed on hfsplus_fill_super()
hfsplus: fix held lock freed on hfsplusfillsuper()
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Upgrade
Upgrade
Linux kernel (HFSPlus)to a version that resolves this vulnerability.Patch hfsplus: fix held lock freed on hfsplus_fill_super() - Configuration
In the hfsplus_fill_super() error path, ensure the missing hfs_find_exit(&fd) is called before jumping to the out_put_root label, so tree->tree_lock is properly released and the held lock freed warning is avoided.
Linux kernel HFSPlus (fs/hfsplus) Add missing hfs_find_exit(&fd) call = before jumping from error label without releasing the lock
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46299?
CVE-2026-46299 has a risk rating of 12, indicating a critical vulnerability.
How do I fix CVE-2026-46299?
To fix CVE-2026-46299, you should apply the latest security updates and patches provided for the Linux kernel.
What systems are affected by CVE-2026-46299?
CVE-2026-46299 affects systems running the Linux kernel with hfsplus file system support.
What are the potential consequences of CVE-2026-46299?
Exploitation of CVE-2026-46299 could lead to system instability or unauthorized access due to improper lock handling.
When was CVE-2026-46299 published?
CVE-2026-46299 was published on June 8, 2026.