A critical memory corruption vulnerability in the Linux kernel HFS+ filesystem could allow an authenticated local attacker to achieve system compromise.

The hfsplus_delete_cat function fails to properly validate thread record sizes before rebuilding catalog keys, leading to an out of bounds write when processing malicious HFS+ filesystem images. This flaw requires the attacker to have local access and the ability to mount or interact with a specially crafted HFS+ filesystem.

Successful exploitation of this vulnerability allows an attacker to write past allocated memory buffers, which can result in privilege escalation or arbitrary code execution within the kernel context. Given the CVSS score of 7.8, the impact is considered High as it directly compromises the integrity and confidentiality of the host operating system, potentially leading to total system takeover.

Immediate Action: Update the Linux kernel to the corrected versions (5.10.270, 5.15.221, 6.1.188, or 6.6.157) provided by your distribution vendor as soon as possible.

Proactive Monitoring: Monitor system logs for kernel oops or segmentation faults occurring during filesystem mount operations or HFS+ related file deletions.

Compensating Controls: Restrict the ability of unprivileged users to mount removable media or arbitrary filesystem images to prevent the introduction of malicious HFS+ volumes.

Public Exploit Available: No — exploit_available (unknown).

This vulnerability represents a significant risk to systems that process untrusted HFS+ media. Administrators should prioritize patching the kernel to the recommended versions to eliminate the underlying memory safety issue. Until patches can be applied, limiting access to filesystem mounting functions is a necessary defensive measure to prevent local exploitation.