PT-2025-51567 · Linux+2 · Linux Kernel+2
Published
2025-08-31
·
Updated
2026-05-07
·
CVE-2025-40351
CVSS v2.0
4.6
Medium
| Vector | AV:L/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.12.0-rc6-dirty #17
Description
The Linux kernel contains a flaw in the HFS+ file system implementation. Specifically, a kernel memory safety issue (KMSAN) exists due to an uninitialized value in the
hfsplus delete cat() function. This issue can lead to a kernel panic, as reported by the syzbot testing framework. The issue is related to memory allocation and handling within the HFS+ file system, potentially triggered during directory removal operations. The call trace indicates involvement of functions such as hfsplus subfolders dec, hfsplus rmdir, vfs rmdir, and do rmdir. The root cause appears to be related to uninitialized memory being used in the hfsplus subfolders inc function, which is called during the creation of catalog entries.Recommendations
Update to a newer version of the Linux kernel that addresses this issue.
Exploit
Fix
Improper Resource Release
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Ubuntu