The Linux kernel's hfsplus_bmap_alloc function in the HFS+ filesystem code did not properly validate the record offset and length before using them to access memory pages. If these values exceeded the node size, the function could access memory outside the allocated node range, causing a slab-out-of-bounds error detected by KASAN and leading to a kernel crash. The vulnerability is addressed by adding validation checks for offset and length before use, preventing out-of-bounds page access. This fix moves validation helper functions to a shared header for broader use.

Exploitation of this vulnerability can cause a kernel crash resulting in denial of service. The CVSS vector indicates local attack vector with low complexity and low privileges required, no user interaction, and impacts confidentiality, integrity, and availability at a high level. This means an attacker with local access and limited privileges could trigger the vulnerability to crash the system and potentially affect data confidentiality and integrity.

A patch has been applied to the Linux kernel to validate record offset and length in hfsplus_bmap_alloc, preventing out-of-bounds memory access. Users and administrators should update to the fixed Linux kernel version once available. Patch status is not explicitly confirmed in the provided data, so check the official Linux kernel advisories or vendor sources for the exact fixed versions and apply updates accordingly.