CVE-2026-74414
Description
In the Linux kernel, the following vulnerability has been resolved: hfsplus: Remove the duplicate attr inode dirty marking action Syzbot reported a null-ptr-deref in [1]. If the attributes file is not loaded during system mount, a trigger occurs [1] when setxattr is executed in userspace. Remove the first mark attr inode dirty operation. [1] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] Call Trace: hfsplus_setxattr+0x124/0x340 fs/hfsplus/xattr.c:555 hfsplus_trusted_setxattr+0x40/0x60 fs/hfsplus/xattr_trusted.c:30 __vfs_setxattr+0x43c/0x480 fs/xattr.c:218 __vfs_setxattr_noperm+0x12d/0x660 fs/xattr.c:252 vfs_setxattr+0x163/0x360 fs/xattr.c:339 do_setxattr fs/xattr.c:654 [inline]
How to fix
- Linux Linuxb3c7ccb1a93cbb5a9a13196abf608ffa2516817e, 7a41fd2b32e5908f19a68732008d581c167279dd or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | ee8422d00b7cfa028823ebf1f28bf9dea428cac3 ≤ v < b3c7ccb1a93cbb5a9a13196abf608ffa2516817e, ee8422d00b7cfa028823ebf1f28bf9dea428cac3 ≤ v < 7a41fd2b32e5908f19a68732008d581c167279dd, 7.1 | b3c7ccb1a93cbb5a9a13196abf608ffa2516817e, 7a41fd2b32e5908f19a68732008d581c167279dd |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.