From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7AE4334250E for ; Mon, 8 Jun 2026 15:47:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780933630; cv=none; b=NVYkR3gT4OLUEZv83LRybN8cLI4noZgabt0wUSaywB88wpPS3MNEd9x+7OQGh7IdwjcYkY2PWCDS6FCQCzFtqRvTVc7avEE1gyc5fgS3VrurN0VnjPPhFFDPCUuFly4X3Wa55OjFeYQKFQizRn2J/VSR/JXXPOBLrm01Za22yro= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780933630; c=relaxed/simple; bh=UgB917t9BNKm7bIWont0klycCdGxJ0J6QNeuBNq8Xwc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=BseIl+zjvs6LMnMYCFT98B5hId89Iidb2yGAAYIVzZmjyb6pH75xfZy6AreRzu3YEqcUY/FNoDdzgi2KmJd/7Gy68tDFpthmZiU6RW97nS9jWb0DsVJq1oky73Hf+9FDPT8M2Ca980ZQAsaiTLhBkyQJfX7CgsuW+KkZB8RAfEA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=gSycLpTR; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="gSycLpTR" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 726681F00898; Mon, 8 Jun 2026 15:47:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1780933629; bh=XBu6WfvxlZDIyXUNLYZ56D0esSTk7+wCHlCyERy4Rd8=; h=From:To:Cc:Subject:Date:Reply-To; b=gSycLpTR08DF9WxmJHDJ5l1ztTLJzItIG1J0Z8BjQYSitG176Wz1BHtLpP0NiMSax 4aNHLJlH+sa2/RCD9nexl4f2D6HOY3zLI0u49QjACzXAfx23Z6oSw0nQLq+ZH4Ndgd XM9/sXFvvvkyykPPEf3t1Puuyi8qHOra3CbkUaCc= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-46299: hfsplus: fix held lock freed on hfsplus_fill_super() Date: Mon, 8 Jun 2026 17:46:07 +0200 Message-ID: <2026060859-CVE-2026-46299-d660@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=6868; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=EfXtJDVnJEgfkj9lLSb90fPxWUZRJ1LDMTqz2w1szw4=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlqj7eXbRWeLNqpo6AcaqilX3FhWr6tDEOwf7H/f+ZLr +sDzZM6YlkYBJkYZMUUWb5s4zm6v+KQopeh7WmYOaxMIEMYuDgFYCJNOxjmqSyIWJqz7oBv2xb+ jpZK4d4zEr+lGOYZpEad/WZgu+r/yZk7HSL+crR/erwHAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix held lock freed on hfsplus_fill_super() hfsplus_fill_super() calls hfs_find_init() to initialize a search structure, which acquires tree->tree_lock. If the subsequent call to hfsplus_cat_build_key() fails, the function jumps to the out_put_root error label without releasing the lock. The later cleanup path then frees the tree data structure with the lock still held, triggering a held lock freed warning. Fix this by adding the missing hfs_find_exit(&fd) call before jumping to the out_put_root error label. This ensures that tree->tree_lock is properly released on the error path. The bug was originally detected on v6.13-rc1 using an experimental static analysis tool we are developing, and we have verified that the issue persists in the latest mainline kernel. The tool is specifically designed to detect memory management issues. It is currently under active development and not yet publicly available. We confirmed the bug by runtime testing under QEMU with x86_64 defconfig, lockdep enabled, and CONFIG_HFSPLUS_FS=y. To trigger the error path, we used GDB to dynamically shrink the max_unistr_len parameter to 1 before hfsplus_asc2uni() is called. This forces hfsplus_asc2uni() to naturally return -ENAMETOOLONG, which propagates to hfsplus_cat_build_key() and exercises the faulty error path. The following warning was observed during mount: ========================= WARNING: held lock freed! 7.0.0-rc3-00016-gb4f0dd314b39 #4 Not tainted ------------------------- mount/174 is freeing memory ffff888103f92000-ffff888103f92fff, with a lock still held there! ffff888103f920b0 (&tree->tree_lock){+.+.}-{4:4}, at: hfsplus_find_init+0x154/0x1e0 2 locks held by mount/174: #0: ffff888103f960e0 (&type->s_umount_key#42/1){+.+.}-{4:4}, at: alloc_super.constprop.0+0x167/0xa40 #1: ffff888103f920b0 (&tree->tree_lock){+.+.}-{4:4}, at: hfsplus_find_init+0x154/0x1e0 stack backtrace: CPU: 2 UID: 0 PID: 174 Comm: mount Not tainted 7.0.0-rc3-00016-gb4f0dd314b39 #4 PREEMPT(lazy) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Call Trace: dump_stack_lvl+0x82/0xd0 debug_check_no_locks_freed+0x13a/0x180 kfree+0x16b/0x510 ? hfsplus_fill_super+0xcb4/0x18a0 hfsplus_fill_super+0xcb4/0x18a0 ? __pfx_hfsplus_fill_super+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? bdev_open+0x65f/0xc30 ? srso_return_thunk+0x5/0x5f ? pointer+0x4ce/0xbf0 ? trace_contention_end+0x11c/0x150 ? __pfx_pointer+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? bdev_open+0x79b/0xc30 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? vsnprintf+0x6da/0x1270 ? srso_return_thunk+0x5/0x5f ? __mutex_unlock_slowpath+0x157/0x740 ? __pfx_vsnprintf+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? mark_held_locks+0x49/0x80 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? irqentry_exit+0x17b/0x5e0 ? trace_irq_disable.constprop.0+0x116/0x150 ? __pfx_hfsplus_fill_super+0x10/0x10 ? __pfx_hfsplus_fill_super+0x10/0x10 get_tree_bdev_flags+0x302/0x580 ? __pfx_get_tree_bdev_flags+0x10/0x10 ? vfs_parse_fs_qstr+0x129/0x1a0 ? __pfx_vfs_parse_fs_qstr+0x3/0x10 vfs_get_tree+0x89/0x320 fc_mount+0x10/0x1d0 path_mount+0x5c5/0x21c0 ? __pfx_path_mount+0x10/0x10 ? trace_irq_enable.constprop.0+0x116/0x150 ? trace_irq_enable.constprop.0+0x116/0x150 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? kmem_cache_free+0x307/0x540 ? user_path_at+0x51/0x60 ? __x64_sys_mount+0x212/0x280 ? srso_return_thunk+0x5/0x5f __x64_sys_mount+0x212/0x280 ? __pfx___x64_sys_mount+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? trace_irq_enable.constprop.0+0x116/0x150 ? srso_return_thunk+0x5/0x5f do_syscall_64+0x111/0x680 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ffacad55eae Code: 48 8b 0d 85 1f 0f 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 8 RSP: 002b:00007fff1ab55718 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffacad55eae RDX: 000055740c64e5b0 RSI: 000055740c64e630 RDI: 000055740c651ab0 RBP: 000055740c64e380 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000055740c64e5b0 R14: 000055740c651ab0 R15: 000055740c64e380 After applying this patch, the warning no longer appears. The Linux kernel CVE team has assigned CVE-2026-46299 to this issue. Affected and fixed versions =========================== Issue introduced in 3.19 with commit 89ac9b4d3d1a049ae1054f99b1aed81092cd0a82 and fixed in 6.6.140 with commit 3ca80e3012c8be85b4f8d0d20eac8d3b17ff257e Issue introduced in 3.19 with commit 89ac9b4d3d1a049ae1054f99b1aed81092cd0a82 and fixed in 6.12.88 with commit 041acda6d9f96006703466449c10c9a69590c8b9 Issue introduced in 3.19 with commit 89ac9b4d3d1a049ae1054f99b1aed81092cd0a82 and fixed in 6.18.30 with commit d309d3308de658d87c42d97e044c89a226327526 Issue introduced in 3.19 with commit 89ac9b4d3d1a049ae1054f99b1aed81092cd0a82 and fixed in 7.0.7 with commit bfbcce6a7b0552a390620d9b2c4d2bcb1825cbdc Issue introduced in 3.19 with commit 89ac9b4d3d1a049ae1054f99b1aed81092cd0a82 and fixed in 7.1-rc1 with commit 90c500e4fd83fa33c09bc7ee23b6d9cc487ac733 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-46299 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/hfsplus/super.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3ca80e3012c8be85b4f8d0d20eac8d3b17ff257e https://git.kernel.org/stable/c/041acda6d9f96006703466449c10c9a69590c8b9 https://git.kernel.org/stable/c/d309d3308de658d87c42d97e044c89a226327526 https://git.kernel.org/stable/c/bfbcce6a7b0552a390620d9b2c4d2bcb1825cbdc https://git.kernel.org/stable/c/90c500e4fd83fa33c09bc7ee23b6d9cc487ac733