CVE-2025-38714
High · 7.1CVSS
7.1
EPSS
0.2%
Published
Sep 4, 2025
CISA due date
—
Cloudanix analysis
A bug in the Linux kernel's handling of certain older Mac filesystems can let a local user crash the system or read kernel memory by deleting files.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Out-of-bounds read in hfsplus_bnode_read() allows kernel memory disclosure or slab corruption when processing malformed HFS+ catalog entries during attribute deletion or file unlink.
Why it matters to the business
Systems mounting HFS+ volumes risk kernel crashes, information leaks, or local privilege escalation during routine file operations, with high urgency for environments running unpatched kernels containing the vulnerable HFS+ driver.
How an attack unfolds
An attacker with local access mounts a crafted HFS+ image, performs unlink or extended attribute deletion operations that invoke hfsplus_bnode_read via hfsplus_delete_cat and related functions, triggering the slab-out-of-bounds read observed in KASAN traces.
How to fix it
Upgrade the Linux kernel to the commit 032f7ed6717a4cd3714f9801be39fdfc7f1c7644 or later stable release containing the hfsplus_bnode_read bounds fix; rebuild and reboot all affected systems.
How to confirm the fix worked
Confirm kernel source contains the fix commit, verify no KASAN reports for hfsplus_bnode_read during HFS+ unlink/delete operations, and test on reproducer images.
Typical attack path
- Mount malicious HFS+ filesystem image
- Trigger hfsplus_unlink or hfsplus_delete_all_attrs on crafted catalog entries
- Invoke hfsplus_brec_remove leading to hfsplus_bnode_read with oversized read
- Trigger slab-out-of-bounds memory access causing KASAN report or exploitable corruption
How to detect it
Search kernel logs and KASAN reports for 'slab-out-of-bounds in hfsplus_bnode_read', 'hfsplus_bnode_dump', and call traces involving hfsplus_delete_cat or do_unlinkat on HFS+ mounts.
- BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read
- hfsplus_bnode_read+0x2f4/0x360
- hfsplus_delete_cat
- hfsplus_unlink
What your security team should do
- Immediately upgrade all kernels to the fixed commit 032f7ed6717a4cd3714f9801be39fdfc7f1c7644
- Disable HFS+ support via CONFIG_HFSPLUS_FS=n where not required
- Monitor kernel logs for hfsplus-related KASAN or slab errors
- Prioritize patching systems with high HFS+ usage or container workloads
The record
In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() The hfsplus_bnode_read() method can trigger the issue: [ 174.852007][ T9784] ================================================================== [ 174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360 [ 174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784 [ 174.854059][ T9784] [ 174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full) [ 174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 174.854286][ T9784] Call Trace: [ 174.854289][ T9784] <TASK> [ 174.854292][ T9784] dump_stack_lvl+0x10e/0x1f0 [ 174.854305][ T9784] print_report+0xd0/0x660 [ 174.854315][ T9784] ? __virt_addr_valid+0x81/0x610 [ 174.854323][ T9784] ? __phys_addr+0xe8/0x180 [ 174.854330][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854337][ T9784] kasan_report+0xc6/0x100 [ 174.854346][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854354][ T9784] hfsplus_bnode_read+0x2f4/0x360 [ 174.854362][ T9784] hfsplus_bnode_dump+0x2ec/0x380 [ 174.854370][ T9784] ? __pfx_hfsplus_bnode_dump+0x10/0x10 [ 174.854377][ T9784] ? hfsplus_bnode_write_u16+0x83/0xb0 [ 174.854385][ T9784] ? srcu_gp_start+0xd0/0x310 [ 174.854393][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854402][ T9784] hfsplus_brec_remove+0x3d2/0x4e0 [ 174.854411][ T9784] __hfsplus_delete_attr+0x290/0x3a0 [ 174.854419][ T9784] ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10 [ 174.854427][ T9784] ? __pfx___hfsplus_delete_attr+0x10/0x10 [ 174.854436][ T9784] ? __asan_memset+0x23/0x50 [ 174.854450][ T9784] hfsplus_delete_all_attrs+0x262/0x320 [ 174.854459][ T9784] ? __pfx_hfsplus_delete_all_attrs+0x10/0x10 [ 174.854469][ T9784] ? rcu_is_watching+0x12/0xc0 [ 174.854476][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854483][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.854493][ T9784] ? __pfx_hfsplus_delete_cat+0x10/0x10 [ 174.854507][ T9784] hfsplus_unlink+0x1ca/0x7c0 [ 174.854516][ T9784] ? __pfx_hfsplus_unlink+0x10/0x10 [ 174.854525][ T9784] ? down_write+0x148/0x200 [ 174.854532][ T9784] ? __pfx_down_write+0x10/0x10 [ 174.854540][ T9784] vfs_unlink+0x2fe/0x9b0 [ 174.854549][ T9784] do_unlinkat+0x490/0x670 [ 174.854557][ T9784] ? __pfx_do_unlinkat+0x10/0x10 [ 174.854565][ T9784] ? __might_fault+0xbc/0x130 [ 174.854576][ T9784] ? getname_flags.part.0+0x1c5/0x550 [ 174.854584][ T9784] __x64_sys_unlink+0xc5/0x110 [ 174.854592][ T9784] do_syscall_64+0xc9/0x480 [ 174.854600][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167 [ 174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08 [ 174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167 [ 174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50 [ 174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40 [ 174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0 [ 174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 174.854658][ T9784] </TASK> [ 174.854661][ T9784] [ 174.879281][ T9784] Allocated by task 9784: [ 174.879664][ T9784] kasan_save_stack+0x20/0x40 [ 174.880082][ T9784] kasan_save_track+0x14/0x30 [ 174.880500][ T9784] __kasan_kmalloc+0xaa/0xb0 [ 174.880908][ T9784] __kmalloc_noprof+0x205/0x550 [ 174.881337][ T9784] __hfs_bnode_create+0x107/0x890 [ 174.881779][ T9784] hfsplus_bnode_find+0x2d0/0xd10 [ 174.882222][ T9784] hfsplus_brec_find+0x2b0/0x520 [ 174.882659][ T9784] hfsplus_delete_all_attrs+0x23b/0x3 ---truncated---
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux | 0 | No fix |
| Debian:12 | linux | 0 | No fix |
| Debian:13 | linux | 0 | 6.12.43-1 |
| Debian:14 | linux | 0 | 6.16.3-1 |
| Linux | Kernel | 0 | 5.4.297 |
| Linux | Kernel | 2.6.12 | 5.4.297 |
| Mageia:9 | kernel | 0 | 6.6.105-1.mga9 |
| Mageia:9 | kernel-linus | 0 | 6.6.105-1.mga9 |
| Mageia:9 | kmod-virtualbox | 0 | 7.1.10-10.mga9 |
| Mageia:9 | kmod-xtables-addons | 0 | 3.24-86.mga9 |
| Mageia:9 | mageia-repos | 0 | 9-4.mga9 |
| Mageia:9 | meta-task | 0 | 9-4.mga9 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.73.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.73.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_16 | 0 | 1-150600.1.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_16 | 0 | 1-150600.13.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_6 | 0 | 1-150700.15.3.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.73.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.73.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.73.1.150600.12.32.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.73.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.73.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-64kb | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-default-base | 0 | 6.4.0-150700.53.22.1.150700.17.15.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-source | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | kernel-zfcpdump | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.73.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.73.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.73.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.73.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-docs | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-obs-build | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-source | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | kernel-syms | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.73.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.52.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.52.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.52.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-azure | 0 | 6.4.0-150700.20.18.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-source-azure | 0 | 6.4.0-150700.20.18.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | kernel-syms-azure | 0 | 6.4.0-150700.20.18.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.73.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP7 | kernel-default | 0 | 6.4.0-150700.53.22.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.55.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.55.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.55.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.55.1 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.73.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.73.1 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.52.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.73.1 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.73.1 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.73.1.150600.12.32.1 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.73.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.73.1 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.73.1 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.73.1 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.55.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.55.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.73.1 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.52.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.55.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.73.1 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.52.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.55.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.73.1 |
Related vulnerabilities
- CVE-2025-39885 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive… Also affects linux
- CVE-2025-39883 In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure… Also affects linux
- CVE-2025-39876 In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix… Also affects linux
- CVE-2025-39869 In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma… Also affects linux
- CVE-2025-39873 In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can… Also affects linux
- CVE-2025-39863 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix… Also affects linux
- CVE-2025-39865 In the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer… Also affects linux
- CVE-2025-39866 In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix… Also affects linux