CVE-2025-40088
Description
A slab-out-of-bounds read flaw was found in the Linux kernel's HFS+ filesystem driver. In hfsplus_strcasecmp(), improper bounds checking during string comparison operations allows reading beyond the allocated slab memory. This can be triggered during filesystem operations such as path lookup or unmount on a crafted or corrupted HFS+ filesystem. A local user with the ability to mount HFS+ filesystems could exploit this to cause a denial of service or potentially leak kernel memory contents.
Statement
This vulnerability requires local access and the ability to mount HFS+ filesystems. The out-of-bounds read could lead to information disclosure or system instability. Systems that do not use HFS+ filesystem support are not affected.
Mitigation
To mitigate this issue, prevent the hfsplus module from being loaded if HFS+ filesystem support is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.1 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
