The vulnerability in the Linux kernel's HFS+ filesystem arises when sync() and link() operations run concurrently, causing two threads to simultaneously attempt to create the same bnode. Thread A creates and inserts the bnode with a reference count of 1, while Thread B detects the bnode already exists and reuses it without incrementing the reference count. This results in both threads having a refcnt of 1, leading to a BUG_ON condition when the node is later released. The fix involves calling hfs_bnode_get() when reusing a bnode created by another thread to correctly increment the reference count and prevent kernel crashes. This bug was previously fixed in the HFS filesystem but remained in HFS+ until now.

The vulnerability can cause kernel crashes (denial of service) due to incorrect reference counting of bnodes in the HFS+ filesystem when concurrent operations occur. There is no indication of confidentiality or integrity impact. The severity is high due to the potential for system instability or denial of service.

A fix has been implemented in the Linux kernel to call hfs_bnode_get() when reusing a bnode created by another thread, ensuring correct reference counting. Users should apply the official kernel update that includes this fix once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.