CVE-2025-38712

What it actually does

Improper input validation in hfsplus_fill_super allows erroneous volume header values to reach hfsplus_create_attributes_file where a BUG_ON triggers a kernel panic instead of returning an error.

Why it matters to the business

Local users or automated processes mounting malformed HFS+ volumes can cause system crashes and unplanned downtime on affected Linux kernels; high ecosystem prevalence in container and server distributions increases patch urgency.

How an attack unfolds

An attacker supplies a crafted or corrupted HFS+ image whose volume header misleads the superblock parser into believing the attributes file does not exist; when hfsplus_create_attributes_file is later invoked the BUG_ON fires and the kernel panics. Threat actors such as VMSCAPE and campaigns exploiting related Linux kernel privilege-escalation CVEs may chain this availability issue with other flaws.

How to fix it

Upgrade to fixed kernel commit bb0eea8e375677f586ad11c12e2525ed3fc698c2 or later; for listed MinimOS packages apply version 18.2.2-r0 or newer. After upgrade, run fsck on any suspect HFS+ volumes before mounting.

How to confirm the fix worked

Confirm kernel version contains the referenced commit; attempt to mount a volume with deliberately inconsistent header values and verify -EIO is returned with an fsck suggestion instead of a BUG_ON panic.

Typical attack path

1. Obtain local access or ability to supply a filesystem image
2. Prepare HFS+ volume with inconsistent header values that cause hfsplus_fill_super to skip attribute-file creation
3. Mount the image triggering the code path that calls hfsplus_create_attributes_file
4. Trigger the BUG_ON resulting in kernel panic and denial of service

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for hfsplus_create_attributes_file, BUG_ON, or hfsplus_fill_super error paths; correlate with mount attempts of HFS+ volumes around the time of any kernel oops or panic.

• hfsplus_create_attributes_file
• hfsplus_fill_super
• BUG_ON.*attributes file
• hfsplus.*EIO
• fsck.*hfsplus

What your security team should do

• Immediately update all affected Linux kernels and MinimOS packages to the listed fixed versions
• Scan logs for prior hfsplus BUG_ON or kernel panic events before and after patching
• Restrict untrusted HFS+ image mounting via mount options or SELinux/AppArmor policies until patches are deployed