Executive brief
A vulnerability was identified in the Linux kernel's HFS file system driver, which is used to read and write older Apple-formatted disks. Due to a memory initialization error, the system could process 'garbage' data as valid file system information. This could lead to data corruption, system instability, or potentially allow a local user to access sensitive information from the system's memory.
Technical details
A KMSAN uninit-value issue was discovered in the hfs_find_set_zero_bits() function within fs/hfs/bitmap.c. The root cause is the use of kmalloc() instead of kzalloc() when allocating the HFS_SB(sb)->bitmap buffer in hfs_mdb_get(). Because kmalloc does not zero out the allocated memory, 'garbage' data from previous kernel operations can remain in the bitmap. This uninitialized data affects bitmap operations, potentially causing the file system driver to misinterpret free/used blocks, leading to volume corruption or the leakage of kernel memory contents. The fix involves replacing kmalloc with kzalloc to ensure the bitmap is properly initialized to zero.
Affected products
- Linux Linux kernel versions prior to 6.16.0-syzkaller (specifically affecting HFS file system module)
Timeline
- 2025-08-20: disclosed: Initial patch submitted by Viacheslav Dubeyko
- 2025-10-29: patched: Patch committed to stable branches
- 2025-12-04: advisory: CVE-2025-40243 published
References
- https://git.kernel.org/stable/c/2048ec5b98dbdfe0b929d2e42dc7a54c389c53dd
- https://git.kernel.org/stable/c/2a112cdd66f5a132da5235ca31a320528c86bf33
- https://git.kernel.org/stable/c/3b447fd401824e1ccf0b769188edefe866a1e676
- https://git.kernel.org/stable/c/502fa92a71f344611101bd04ef1a595b8b6014f5
- https://git.kernel.org/stable/c/bf1683078fbdd09a7f7f9b74121ebaa03432bd00
- https://git.kernel.org/stable/c/cfafefcb0e1fc60135f7040f4aed0a4aef4f76ca
- https://git.kernel.org/stable/c/e148ed5cda8fd96d4620c4622fb02f552a2d166a