Executive brief
A vulnerability was identified in the Linux kernel's HFS+ filesystem driver, which is used to read and write Apple-formatted disks. A local attacker could exploit this flaw to read sensitive information from the computer's memory or cause a system crash (Blue Screen/Kernel Panic). This could lead to a loss of data confidentiality or a disruption of business operations on systems that mount HFS+ drives.
Technical details
An out-of-bounds read vulnerability exists in the hfsplus_uni2asc() function within fs/hfsplus/unicode.c. The issue stems from a type mismatch when hfsplus_listxattr passes a 'struct hfsplus_attr_unistr*' to a function expecting 'struct hfsplus_unistr*', which have different memory layouts. This allows the unicode buffer pointer to advance beyond the allocated slab memory during string conversion. A local attacker with the ability to mount or interact with HFS+ filesystems can trigger this via system calls like listxattr. The fix introduces wrapper functions to correctly handle both structure types and enforces bounds checking on the ustrlen value.
Affected products
- Linux Linux Kernel 6.16.4; 3.x; 4.x; 5.x; 6.x
Timeline
- 2025-09-09: disclosed: Initial patch submitted by Kang Chen
- 2025-10-28: advisory: CVE-2025-40082 published
- 2026-02-11: patched: Commits merged into stable branches by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/343fe375a8dd6ee51a193a1c233b999f5ea4d479
- https://git.kernel.org/stable/c/5b5228964619b180f366940505b77255b1a03929
- https://git.kernel.org/stable/c/782acde47e127c98a113726e2ff8024bd65c0454
- https://git.kernel.org/stable/c/857aefc70d4ae3b9bf1ae67434d27d0f79f80c9e
- https://git.kernel.org/stable/c/bea3e1d4467bcf292c8e54f080353d556d355e26
- https://git.kernel.org/stable/c/c3db89ea1ed3d540eebe8f3c36e806fb75ee4a1e