{"id":"CVE-2026-43228","revision":"77987f4d05874a058e8834366013dc7f","records":[{"revision":"77987f4d05874a058e8834366013dc7f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-43228","aliases":[],"title":"hfs: Replace BUG_ON with error handling for CNID count checks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: Replace BUG_ON with error handling for CNID count checks\n\nIn a06ec283e125 next_id, folder_count, and file_count in the super block\ninfo were expanded to 64 bits, and BUG_ONs were added to detect\noverflow. This triggered an error reported by syzbot: if the MDB is\ncorrupted, the BUG_ON is triggered. This patch replaces this mechanism\nwith proper error handling and resolves the syzbot reported bug.\n\nSinged-off-by: Jori Koolstra <jkoolstra@xs4all.nl>","state":0,"publishedAt":"2026-05-06T11:28:26.292+00:00","modifiedAt":"2026-10-15T10:07:13.116+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/hfs/dir.c\",\n                        \"fs/hfs/hfs_fs.h\",\n                        \"fs/hfs/inode.c\",\n                        \"fs/hfs/mdb.c\",\n                        \"fs/hfs/super.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"a06ec283e125e334155fe13005c76c9f484ce759\",\n                            \"lessThan\": \"559f856b109c45844816a1693e259f93d3556c61\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a06ec283e125e334155fe13005c76c9f484ce759\",\n                            \"lessThan\": \"b6536c1ced315fa645576d3a39c6e07f2a472962\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a06ec283e125e334155fe13005c76c9f484ce759\",\n                            \"lessThan\": \"b226804532a875c10276168dc55ce752944096bd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/hfs/dir.c\",\n                        \"fs/hfs/hfs_fs.h\",\n                        \"fs/hfs/inode.c\",\n                        \"fs/hfs/mdb.c\",\n                        \"fs/hfs/super.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.6\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/559f856b109c45844816a1693e259f93d3556c61","https://git.kernel.org/stable/c/b6536c1ced315fa645576d3a39c6e07f2a472962","https://git.kernel.org/stable/c/b226804532a875c10276168dc55ce752944096bd"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43228","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-43228","identifiers":["CVE-2026-43228"]},"retained":false,"historicalAffected":[]}],"coverage":[]}