CVE-2025-38714 (GCVE-0-2025-38714)

Vulnerability from cvelistv5 – Published: 2025-09-04 15:33 – Updated: 2026-08-05 12:04
VLAI
Title
hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()
Summary
In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() The hfsplus_bnode_read() method can trigger the issue: [ 174.852007][ T9784] ================================================================== [ 174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360 [ 174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784 [ 174.854059][ T9784] [ 174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full) [ 174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 174.854286][ T9784] Call Trace: [ 174.854289][ T9784] <TASK> [ 174.854292][ T9784] dump_stack_lvl+0x10e/0x1f0 [ 174.854305][ T9784] print_report+0xd0/0x660 [ 174.854315][ T9784] ? __virt_addr_valid+0x81/0x610 [ 174.854323][ T9784] ? __phys_addr+0xe8/0x180 [ 174.854330][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854337][ T9784] kasan_report+0xc6/0x100 [ 174.854346][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854354][ T9784] hfsplus_bnode_read+0x2f4/0x360 [ 174.854362][ T9784] hfsplus_bnode_dump+0x2ec/0x380 [ 174.854370][ T9784] ? __pfx_hfsplus_bnode_dump+0x10/0x10 [ 174.854377][ T9784] ? hfsplus_bnode_write_u16+0x83/0xb0 [ 174.854385][ T9784] ? srcu_gp_start+0xd0/0x310 [ 174.854393][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854402][ T9784] hfsplus_brec_remove+0x3d2/0x4e0 [ 174.854411][ T9784] __hfsplus_delete_attr+0x290/0x3a0 [ 174.854419][ T9784] ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10 [ 174.854427][ T9784] ? __pfx___hfsplus_delete_attr+0x10/0x10 [ 174.854436][ T9784] ? __asan_memset+0x23/0x50 [ 174.854450][ T9784] hfsplus_delete_all_attrs+0x262/0x320 [ 174.854459][ T9784] ? __pfx_hfsplus_delete_all_attrs+0x10/0x10 [ 174.854469][ T9784] ? rcu_is_watching+0x12/0xc0 [ 174.854476][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854483][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.854493][ T9784] ? __pfx_hfsplus_delete_cat+0x10/0x10 [ 174.854507][ T9784] hfsplus_unlink+0x1ca/0x7c0 [ 174.854516][ T9784] ? __pfx_hfsplus_unlink+0x10/0x10 [ 174.854525][ T9784] ? down_write+0x148/0x200 [ 174.854532][ T9784] ? __pfx_down_write+0x10/0x10 [ 174.854540][ T9784] vfs_unlink+0x2fe/0x9b0 [ 174.854549][ T9784] do_unlinkat+0x490/0x670 [ 174.854557][ T9784] ? __pfx_do_unlinkat+0x10/0x10 [ 174.854565][ T9784] ? __might_fault+0xbc/0x130 [ 174.854576][ T9784] ? getname_flags.part.0+0x1c5/0x550 [ 174.854584][ T9784] __x64_sys_unlink+0xc5/0x110 [ 174.854592][ T9784] do_syscall_64+0xc9/0x480 [ 174.854600][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167 [ 174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08 [ 174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167 [ 174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50 [ 174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40 [ 174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0 [ 174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 174.854658][ T9784] </TASK> [ 174.854661][ T9784] [ 174.879281][ T9784] Allocated by task 9784: [ 174.879664][ T9784] kasan_save_stack+0x20/0x40 [ 174.880082][ T9784] kasan_save_track+0x14/0x30 [ 174.880500][ T9784] __kasan_kmalloc+0xaa/0xb0 [ 174.880908][ T9784] __kmalloc_noprof+0x205/0x550 [ 174.881337][ T9784] __hfs_bnode_create+0x107/0x890 [ 174.881779][ T9784] hfsplus_bnode_find+0x2d0/0xd10 [ 174.882222][ T9784] hfsplus_brec_find+0x2b0/0x520 [ 174.882659][ T9784] hfsplus_delete_all_attrs+0x23b/0x3 ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 032f7ed6717a4cd3714f9801be39fdfc7f1c7644 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ffee8a7bed0fbfe29da239a922b59c5db897c613 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5ab59229bef6063edf3a6fc2e3e3fd7cd2181b29 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a2abd574d2fe22b8464cf6df5abb6f24d809eac0 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8583d067ae22b7f32ce5277ca5543ac8bf86a3e5 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 475d770c19929082aab43337e6c077d0e2043df3 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 291b7f2538920aa229500dbdd6c5f0927a51bc8b (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7fa4cef8ea13b37811287ef60674c5fd1dd02ee6 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c80aa2aaaa5e69d5219c6af8ef7e754114bd08d2 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.12
Unaffected: 0 , < 2.6.12 (semver)
Unaffected: 5.4.297 , ≤ 5.4.* (semver)
Unaffected: 5.10.241 , ≤ 5.10.* (semver)
Unaffected: 5.15.190 , ≤ 5.15.* (semver)
Unaffected: 6.1.149 , ≤ 6.1.* (semver)
Unaffected: 6.6.103 , ≤ 6.6.* (semver)
Unaffected: 6.12.43 , ≤ 6.12.* (semver)
Unaffected: 6.15.11 , ≤ 6.15.* (semver)
Unaffected: 6.16.2 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens SIMATIC CN 4100 Affected: 0 , < V5.0 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:41:45.902Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:05:49.355Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/hfsplus/bnode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "032f7ed6717a4cd3714f9801be39fdfc7f1c7644",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "ffee8a7bed0fbfe29da239a922b59c5db897c613",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5ab59229bef6063edf3a6fc2e3e3fd7cd2181b29",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a2abd574d2fe22b8464cf6df5abb6f24d809eac0",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "8583d067ae22b7f32ce5277ca5543ac8bf86a3e5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "475d770c19929082aab43337e6c077d0e2043df3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "291b7f2538920aa229500dbdd6c5f0927a51bc8b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7fa4cef8ea13b37811287ef60674c5fd1dd02ee6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c80aa2aaaa5e69d5219c6af8ef7e754114bd08d2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/hfsplus/bnode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()\n\nThe hfsplus_bnode_read() method can trigger the issue:\n\n[  174.852007][ T9784] ==================================================================\n[  174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360\n[  174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784\n[  174.854059][ T9784]\n[  174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full)\n[  174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[  174.854286][ T9784] Call Trace:\n[  174.854289][ T9784]  \u003cTASK\u003e\n[  174.854292][ T9784]  dump_stack_lvl+0x10e/0x1f0\n[  174.854305][ T9784]  print_report+0xd0/0x660\n[  174.854315][ T9784]  ? __virt_addr_valid+0x81/0x610\n[  174.854323][ T9784]  ? __phys_addr+0xe8/0x180\n[  174.854330][ T9784]  ? hfsplus_bnode_read+0x2f4/0x360\n[  174.854337][ T9784]  kasan_report+0xc6/0x100\n[  174.854346][ T9784]  ? hfsplus_bnode_read+0x2f4/0x360\n[  174.854354][ T9784]  hfsplus_bnode_read+0x2f4/0x360\n[  174.854362][ T9784]  hfsplus_bnode_dump+0x2ec/0x380\n[  174.854370][ T9784]  ? __pfx_hfsplus_bnode_dump+0x10/0x10\n[  174.854377][ T9784]  ? hfsplus_bnode_write_u16+0x83/0xb0\n[  174.854385][ T9784]  ? srcu_gp_start+0xd0/0x310\n[  174.854393][ T9784]  ? __mark_inode_dirty+0x29e/0xe40\n[  174.854402][ T9784]  hfsplus_brec_remove+0x3d2/0x4e0\n[  174.854411][ T9784]  __hfsplus_delete_attr+0x290/0x3a0\n[  174.854419][ T9784]  ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10\n[  174.854427][ T9784]  ? __pfx___hfsplus_delete_attr+0x10/0x10\n[  174.854436][ T9784]  ? __asan_memset+0x23/0x50\n[  174.854450][ T9784]  hfsplus_delete_all_attrs+0x262/0x320\n[  174.854459][ T9784]  ? __pfx_hfsplus_delete_all_attrs+0x10/0x10\n[  174.854469][ T9784]  ? rcu_is_watching+0x12/0xc0\n[  174.854476][ T9784]  ? __mark_inode_dirty+0x29e/0xe40\n[  174.854483][ T9784]  hfsplus_delete_cat+0x845/0xde0\n[  174.854493][ T9784]  ? __pfx_hfsplus_delete_cat+0x10/0x10\n[  174.854507][ T9784]  hfsplus_unlink+0x1ca/0x7c0\n[  174.854516][ T9784]  ? __pfx_hfsplus_unlink+0x10/0x10\n[  174.854525][ T9784]  ? down_write+0x148/0x200\n[  174.854532][ T9784]  ? __pfx_down_write+0x10/0x10\n[  174.854540][ T9784]  vfs_unlink+0x2fe/0x9b0\n[  174.854549][ T9784]  do_unlinkat+0x490/0x670\n[  174.854557][ T9784]  ? __pfx_do_unlinkat+0x10/0x10\n[  174.854565][ T9784]  ? __might_fault+0xbc/0x130\n[  174.854576][ T9784]  ? getname_flags.part.0+0x1c5/0x550\n[  174.854584][ T9784]  __x64_sys_unlink+0xc5/0x110\n[  174.854592][ T9784]  do_syscall_64+0xc9/0x480\n[  174.854600][ T9784]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[  174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167\n[  174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08\n[  174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057\n[  174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167\n[  174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50\n[  174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40\n[  174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0\n[  174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[  174.854658][ T9784]  \u003c/TASK\u003e\n[  174.854661][ T9784]\n[  174.879281][ T9784] Allocated by task 9784:\n[  174.879664][ T9784]  kasan_save_stack+0x20/0x40\n[  174.880082][ T9784]  kasan_save_track+0x14/0x30\n[  174.880500][ T9784]  __kasan_kmalloc+0xaa/0xb0\n[  174.880908][ T9784]  __kmalloc_noprof+0x205/0x550\n[  174.881337][ T9784]  __hfs_bnode_create+0x107/0x890\n[  174.881779][ T9784]  hfsplus_bnode_find+0x2d0/0xd10\n[  174.882222][ T9784]  hfsplus_brec_find+0x2b0/0x520\n[  174.882659][ T9784]  hfsplus_delete_all_attrs+0x23b/0x3\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only by mounting a crafted HFS+ volume (loop-backed image or removable media) and then issuing ordinary syscalls \u2014 `unlink(2)`/`rmdir(2)` driving `hfsplus_delete_all_attrs` \u2192 `hfs_brec_remove` \u2192 `hfs_bnode_dump`, or `readdir`/`getxattr` driving `__hfs_brec_find`. No remote or network-facing consumer of fs/hfsplus/bnode.c exists.\nAC:L - The out-of-bounds index is taken verbatim from on-disk 16-bit fields the attacker authors \u2014 record offsets returned by `hfs_brec_lenoff()` and the node descriptor\u0027s `num_recs` \u2014 so a single purpose-built image triggers it deterministically on the first unlink. There is no race, timing window, or memory-layout precondition outside the attacker\u0027s control, and the adjacent kmalloc-192 slab contents can be groomed by repeated bnode allocations.\nPR:L - The bare `mount(2)` needs CAP_SYS_ADMIN since hfsplus is FS_REQUIRES_DEV without FS_USERNS_MOUNT, but in the most severe reasonable deployment an unprivileged local user routinely gets an attacker-controlled HFS+ image mounted via udisks2 loop-setup/mount in a desktop session, removable-media automounters on kiosks and embedded systems, or `user`/autofs fstab delegation. Once mounted, the unlink/rmdir/readdir that fires the bug needs no privilege at all.\nUI:N - The attacker performs every step personally \u2014 presents the crafted volume (which the automounter consumes without any human action) and then runs the unlink or rmdir that reaches `hfs_brec_remove()`. No second, victim user has to be induced into any action.\nS:U - The corruption occurs in HFS+ btree node handling inside the kernel and its effects stay within that same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unvalidated index loads a `struct page *` from out-of-bounds slab memory and `memcpy_from_page()` then copies up to a full page from the arbitrary kernel address that pointer resolves to. That data lands in `fd-\u003ekey` and in catalog/attribute record buffers (bfind.c:222) that are handed straight back to userspace via readdir, getxattr, and listxattr, giving a repeatable arbitrary-kernel-memory disclosure primitive.\nI:H - The identical bogus `struct page *` is used on the write side by `hfs_bnode_write()`, `hfs_bnode_clear()`, `hfs_bnode_copy()`, and `hfs_bnode_move()`, whose `memcpy_to_page()`/`memmove()` deposit attacker-chosen bytes at an arbitrary kernel address. `hfs_brec_remove()` compounds this by passing `data_off - fd-\u003ekeyoffset - size`, which underflows from on-disk u16 values into an enormous length \u2014 an out-of-bounds write suitable for corrupting adjacent kernel objects and hijacking control flow.\nA:H - Dereferencing a garbage `struct page *` faults or corrupts memory in the middle of an unlink while holding the inode lock and the btree mutex, producing an oops that wedges the filesystem and leaks the held locks. On systems with `panic_on_oops` \u2014 standard in appliances, automotive, and embedded builds \u2014 it is an immediate full system panic, and the attacker can repeat it at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:12.650Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/032f7ed6717a4cd3714f9801be39fdfc7f1c7644"
        },
        {
          "url": "https://git.kernel.org/stable/c/ffee8a7bed0fbfe29da239a922b59c5db897c613"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ab59229bef6063edf3a6fc2e3e3fd7cd2181b29"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2abd574d2fe22b8464cf6df5abb6f24d809eac0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8583d067ae22b7f32ce5277ca5543ac8bf86a3e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/475d770c19929082aab43337e6c077d0e2043df3"
        },
        {
          "url": "https://git.kernel.org/stable/c/291b7f2538920aa229500dbdd6c5f0927a51bc8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7fa4cef8ea13b37811287ef60674c5fd1dd02ee6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c80aa2aaaa5e69d5219c6af8ef7e754114bd08d2"
        }
      ],
      "title": "hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38714",
    "datePublished": "2025-09-04T15:33:09.206Z",
    "dateReserved": "2025-04-16T04:51:24.033Z",
    "dateUpdated": "2026-08-05T12:04:12.650Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38714",
      "date": "2026-08-06",
      "epss": "0.00167",
      "percentile": "0.06275"
    },
    "microsoft_vex": {
      "current_release_date": "2026-01-13T01:44:09.000Z",
      "cve": "CVE-2025-38714",
      "id": "msrc_CVE-2025-38714",
      "initial_release_date": "2025-09-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38714.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38714\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-04T16:15:40.820\",\"lastModified\":\"2026-07-30T06:23:36.310\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()\\n\\nThe hfsplus_bnode_read() method can trigger the issue:\\n\\n[  174.852007][ T9784] ==================================================================\\n[  174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360\\n[  174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784\\n[  174.854059][ T9784]\\n[  174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full)\\n[  174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n[  174.854286][ T9784] Call Trace:\\n[  174.854289][ T9784]  \u003cTASK\u003e\\n[  174.854292][ T9784]  dump_stack_lvl+0x10e/0x1f0\\n[  174.854305][ T9784]  print_report+0xd0/0x660\\n[  174.854315][ T9784]  ? __virt_addr_valid+0x81/0x610\\n[  174.854323][ T9784]  ? __phys_addr+0xe8/0x180\\n[  174.854330][ T9784]  ? hfsplus_bnode_read+0x2f4/0x360\\n[  174.854337][ T9784]  kasan_report+0xc6/0x100\\n[  174.854346][ T9784]  ? hfsplus_bnode_read+0x2f4/0x360\\n[  174.854354][ T9784]  hfsplus_bnode_read+0x2f4/0x360\\n[  174.854362][ T9784]  hfsplus_bnode_dump+0x2ec/0x380\\n[  174.854370][ T9784]  ? __pfx_hfsplus_bnode_dump+0x10/0x10\\n[  174.854377][ T9784]  ? hfsplus_bnode_write_u16+0x83/0xb0\\n[  174.854385][ T9784]  ? srcu_gp_start+0xd0/0x310\\n[  174.854393][ T9784]  ? __mark_inode_dirty+0x29e/0xe40\\n[  174.854402][ T9784]  hfsplus_brec_remove+0x3d2/0x4e0\\n[  174.854411][ T9784]  __hfsplus_delete_attr+0x290/0x3a0\\n[  174.854419][ T9784]  ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10\\n[  174.854427][ T9784]  ? __pfx___hfsplus_delete_attr+0x10/0x10\\n[  174.854436][ T9784]  ? __asan_memset+0x23/0x50\\n[  174.854450][ T9784]  hfsplus_delete_all_attrs+0x262/0x320\\n[  174.854459][ T9784]  ? __pfx_hfsplus_delete_all_attrs+0x10/0x10\\n[  174.854469][ T9784]  ? rcu_is_watching+0x12/0xc0\\n[  174.854476][ T9784]  ? __mark_inode_dirty+0x29e/0xe40\\n[  174.854483][ T9784]  hfsplus_delete_cat+0x845/0xde0\\n[  174.854493][ T9784]  ? __pfx_hfsplus_delete_cat+0x10/0x10\\n[  174.854507][ T9784]  hfsplus_unlink+0x1ca/0x7c0\\n[  174.854516][ T9784]  ? __pfx_hfsplus_unlink+0x10/0x10\\n[  174.854525][ T9784]  ? down_write+0x148/0x200\\n[  174.854532][ T9784]  ? __pfx_down_write+0x10/0x10\\n[  174.854540][ T9784]  vfs_unlink+0x2fe/0x9b0\\n[  174.854549][ T9784]  do_unlinkat+0x490/0x670\\n[  174.854557][ T9784]  ? __pfx_do_unlinkat+0x10/0x10\\n[  174.854565][ T9784]  ? __might_fault+0xbc/0x130\\n[  174.854576][ T9784]  ? getname_flags.part.0+0x1c5/0x550\\n[  174.854584][ T9784]  __x64_sys_unlink+0xc5/0x110\\n[  174.854592][ T9784]  do_syscall_64+0xc9/0x480\\n[  174.854600][ T9784]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n[  174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167\\n[  174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08\\n[  174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057\\n[  174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167\\n[  174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50\\n[  174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40\\n[  174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0\\n[  174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\\n[  174.854658][ T9784]  \u003c/TASK\u003e\\n[  174.854661][ T9784]\\n[  174.879281][ T9784] Allocated by task 9784:\\n[  174.879664][ T9784]  kasan_save_stack+0x20/0x40\\n[  174.880082][ T9784]  kasan_save_track+0x14/0x30\\n[  174.880500][ T9784]  __kasan_kmalloc+0xaa/0xb0\\n[  174.880908][ T9784]  __kmalloc_noprof+0x205/0x550\\n[  174.881337][ T9784]  __hfs_bnode_create+0x107/0x890\\n[  174.881779][ T9784]  hfsplus_bnode_find+0x2d0/0xd10\\n[  174.882222][ T9784]  hfsplus_brec_find+0x2b0/0x520\\n[  174.882659][ T9784]  hfsplus_delete_all_attrs+0x23b/0x3\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/hfsplus/bnode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"032f7ed6717a4cd3714f9801be39fdfc7f1c7644\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"ffee8a7bed0fbfe29da239a922b59c5db897c613\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"5ab59229bef6063edf3a6fc2e3e3fd7cd2181b29\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"a2abd574d2fe22b8464cf6df5abb6f24d809eac0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"8583d067ae22b7f32ce5277ca5543ac8bf86a3e5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"475d770c19929082aab43337e6c077d0e2043df3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"291b7f2538920aa229500dbdd6c5f0927a51bc8b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"7fa4cef8ea13b37811287ef60674c5fd1dd02ee6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"c80aa2aaaa5e69d5219c6af8ef7e754114bd08d2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/hfsplus/bnode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.297\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.241\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.190\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.149\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.103\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.43\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.11\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.2\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC CN 4100\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V5.0\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.13\",\"versionEndExcluding\":\"5.4.297\",\"matchCriteriaId\":\"F9244D35-DE44-43CF-A62B-1D036E3477DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.241\",\"matchCriteriaId\":\"D0D21C35-EB8A-488A-BBF9-403E4817E5DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.190\",\"matchCriteriaId\":\"AD9E597F-3DDE-4D7E-976C-463D0611F13F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.149\",\"matchCriteriaId\":\"FDBE8280-8983-4D2D-943D-2E6D0104E2D8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.103\",\"matchCriteriaId\":\"F2293654-7169-49B5-8D0D-EE51EF8B8E48\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.43\",\"matchCriteriaId\":\"472C5F87-2BF3-4FAB-9B21-DA7513977363\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.11\",\"matchCriteriaId\":\"BC242347-F722-43AE-B910-BE0B22386977\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.16\",\"versionEndExcluding\":\"6.16.2\",\"matchCriteriaId\":\"BD7C087D-2415-4521-B624-30003352F899\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4F76C298-81DC-43E4-8FC9-DC005A2116EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"0AB349B2-3F78-4197-882B-90ADB3BF645A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AC88830-A9BC-4607-B572-A4B502FC9FD0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"476CB3A5-D022-4F13-AAEF-CB6A5785516A\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/032f7ed6717a4cd3714f9801be39fdfc7f1c7644\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/291b7f2538920aa229500dbdd6c5f0927a51bc8b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/475d770c19929082aab43337e6c077d0e2043df3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5ab59229bef6063edf3a6fc2e3e3fd7cd2181b29\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7fa4cef8ea13b37811287ef60674c5fd1dd02ee6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8583d067ae22b7f32ce5277ca5543ac8bf86a3e5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a2abd574d2fe22b8464cf6df5abb6f24d809eac0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c80aa2aaaa5e69d5219c6af8ef7e754114bd08d2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ffee8a7bed0fbfe29da239a922b59c5db897c613\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-032379.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:03:18+00:00",
      "cve": "CVE-2025-38714",
      "id": "CVE-2025-38714",
      "initial_release_date": "2025-09-04T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38714.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.