The vulnerability in the Linux kernel's HFS+ filesystem implementation occurs in the hfsplus_delete_cat() function, which is called when the last open reference to an unlinked HFS+ hardlink backing inode is closed. The function attempts to rebuild the catalog key from a thread record's nodeName without verifying that the record is indeed a thread record or that the size matches the thread name length. This can lead to reading an oversized thread name length from a corrupted image, causing hfs_bnode_read() to write beyond the allocated buffer for the catalog search key. The fix involves reading the CNID record with bounds checking and verifying the thread record size matches nodeName.length, ensuring the thread name fits within HFSPLUS_MAX_STRLEN. Non-thread records are rejected before key reconstruction, mitigating the overflow risk.

Successful exploitation of this vulnerability can lead to out-of-bounds memory writes within the kernel, potentially resulting in privilege escalation, system crashes, or arbitrary code execution with kernel privileges. The CVSS score of 7.8 reflects high impact on confidentiality, integrity, and availability. However, exploitation requires local access with low privileges and no user interaction.

A fix for this vulnerability has been implemented in the Linux kernel by adding validation checks on thread records before rebuilding delete keys in the HFS+ filesystem code. Users and administrators should apply the official Linux kernel updates that include this patch to mitigate the issue. Since this is a kernel vulnerability, running updated kernel versions is critical. No additional mitigation steps are indicated beyond applying the official fix.