Executive brief
A vulnerability in the Linux kernel's HFS+ file system driver could allow a local user to crash the system or potentially access sensitive information. This component is responsible for reading and writing files on disks formatted for older Apple computers. An exploit could lead to a complete system shutdown or unauthorized data exposure, impacting operational stability.
Technical details
A slab-out-of-bounds read vulnerability exists in the Linux kernel's HFS+ file system implementation. The flaw is located in the hfsplus_uni2asc() function, which is called by hfsplus_readdir() during directory iteration. A local attacker with the ability to mount or interact with a specially crafted HFS+ filesystem can trigger an out-of-bounds memory access. This can result in a kernel crash (denial of service) or the leakage of sensitive kernel memory. The issue has been addressed in multiple stable kernel branches including 6.1, 6.6, and 6.10+.
Affected products
- Linux Linux Kernel 6.16.0-rc3
Timeline
- 2025-07-10: patched: Initial patch authored by Viacheslav Dubeyko
- 2025-09-04: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/13604b1d7e7b125fb428cddbec6b8d92baad25d5
- https://git.kernel.org/stable/c/1ca69007e52a73bd8b84b988b61b319816ca8b01
- https://git.kernel.org/stable/c/291bb5d931c6f3cd7227b913302a17be21cf53b0
- https://git.kernel.org/stable/c/6f93694bcbc2c2ab3e01cd8fba2f296faf34e6b9
- https://git.kernel.org/stable/c/73f7da507d787b489761a0fa280716f84fa32b2f
- https://git.kernel.org/stable/c/76a4c6636a69d69409aa253b049b1be717a539c5
- https://git.kernel.org/stable/c/94458781aee6045bd3d0ad4b80b02886b9e2219b