The vulnerability CVE-2026-74414 in the Linux kernel's HFS+ filesystem arises from a null pointer dereference caused by a duplicate attribute inode dirty marking action. Specifically, if the attributes file is not loaded during system mount, invoking setxattr in userspace triggers a null pointer dereference in the hfsplus_setxattr function. The patch removes the first mark attribute inode dirty operation to prevent this condition. The issue was reported by Syzbot and involves kernel address sanitizer (KASAN) detecting a null pointer dereference in a specific memory range during execution of the setxattr code path in the HFS+ filesystem.

This vulnerability can cause a kernel crash (null pointer dereference) when setxattr is called under certain conditions, potentially leading to denial of service. There is no indication of privilege escalation or arbitrary code execution from the provided data. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel by removing the duplicate attribute inode dirty marking action. Users should apply the official Linux kernel updates that include this patch. Since no patch links are provided here, users should consult the official Linux kernel repositories or vendor advisories for the fixed version. Patch status is not yet confirmed in this data — check the vendor advisory for current remediation guidance.