CVE-2025-68774: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68774 is a race condition vulnerability in the Linux kernel's HFS+ filesystem implementation, specifically within the __hfs_bnode_create function. When sync() and link() operations are called concurrently, two threads can both attempt to create the same B-tree node; the second thread reuses the already-hashed node without incrementing its reference count, leading to a kernel panic triggered by the BUG_ON(!atomic_read(&node->refcnt)) assertion. The vulnerability affects the Linux kernel and has been confirmed in Microsoft Azure Linux kernel version azl3_kernel_6.6.119.3-3, as well as multiple Debian and Ubuntu kernel packages. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is a missing call to hfs_bnode_get() in the else branch of __hfs_bnode_create, classified as a concurrent execution race condition (CWE-362). When two threads simultaneously call hfs_bnode_find() and neither finds the target node in the hash table, both proceed to create it. Thread A successfully inserts the node with refcnt=1; Thread B detects the collision, frees its own copy, and returns the hashed node — but omits the required hfs_bnode_get() reference increment. This results in both threads sharing the same reference count, and when either releases its reference, the count drops to zero prematurely, triggering a kernel assertion failure. The fix mirrors a prior correction applied to the HFS (non-plus) filesystem in commit a9dc087fd3c4 (Feedly, Linux Kernel Patch).

Successful exploitation causes a kernel panic (denial of service), crashing the affected system and disrupting all running services. The impact is limited to availability — there is no confidentiality or integrity impact. An unprivileged local user (low privileges required) can trigger the crash through standard file operations (sync() and link()) on an HFS+ mounted volume, making this exploitable in multi-user or shared environments (Feedly).

1. Precondition: Obtain local access to a Linux system with an HFS+ filesystem mounted and a vulnerable kernel version.
2. Setup concurrent operations: Write a program or script that spawns two threads/processes simultaneously — one repeatedly calling sync() to flush filesystem state, and another repeatedly calling link() to create hard links on the HFS+ volume.
3. Trigger the race condition: The concurrent execution causes both threads to enter hfs_bnode_find() and proceed to __hfs_bnode_create() for the same B-tree node (e.g., node 0) without finding it in the hash table.
4. Reference count corruption: Thread A creates and hashes the node with refcnt=1; Thread B detects the existing node, discards its copy, and returns the hashed node without calling hfs_bnode_get(), leaving the reference count incorrect.
5. Kernel panic: When either thread releases its reference, the reference count underflows, triggering the BUG_ON(!atomic_read(&node->refcnt)) assertion and causing a kernel panic (system crash) (Feedly).

• Logs: Kernel panic messages in /var/log/kern.log or dmesg output containing BUG_ON(!atomic_read(&node->refcnt)) or references to hfs_bnode_find, __hfs_bnode_create, or hfsplus stack traces.
• System Events: Unexpected system reboots or kernel oops events on systems with HFS+ volumes mounted, particularly following concurrent file operations.
• Process Behavior: Unusual concurrent invocations of sync() and link() system calls on HFS+ mount points, observable via strace or audit logs targeting those syscalls.

Apply the available kernel patches that add the missing hfs_bnode_get() call in __hfs_bnode_create. Patches have been issued for multiple distributions: Microsoft Azure Linux (azl3_kernel_6.6.119.3-3), Debian (DSA-6126-1, DLA-4475-1), Ubuntu (USN-8177-1/2, USN-8179-1/2/3/4, USN-8183-1/2, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1), and Amazon Linux 2 (ALAS2KERNEL-5.10-2026-113). As a temporary workaround where patching is not immediately possible, avoid mounting HFS+ volumes on affected systems, minimize concurrent sync() and link() operations on HFS+ volumes, and restrict local user access (Feedly, Microsoft MSRC, Debian LTS).