PT-2025-44150 · Linux+4 · Linux Kernel+4
Published
2025-09-09
·
Updated
2026-06-16
·
CVE-2025-40082
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.16.4
Description
The Linux kernel contains a flaw within the HFSplus file system implementation. Specifically, a slab-out-of-bounds read exists in the
hfsplus uni2asc() function when handling extended attributes. This issue arises because the function incorrectly processes Unicode strings, potentially leading to memory corruption when called from hfsplus listxattr. The root cause is an insufficient fix in a previous commit, resulting in a pointer exceeding allocated memory boundaries. The issue is triggered when the ustrlen value exceeds the allocated memory size.Recommendations
Upgrade to Linux kernel version 6.16.4 or later to address this issue.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Suse
Ubuntu