{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/hfs/mdb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fc56548fca732f3d3692c83b40db796259a03887",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "bf1683078fbdd09a7f7f9b74121ebaa03432bd00",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2a112cdd66f5a132da5235ca31a320528c86bf33",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e148ed5cda8fd96d4620c4622fb02f552a2d166a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "cfafefcb0e1fc60135f7040f4aed0a4aef4f76ca",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3b447fd401824e1ccf0b769188edefe866a1e676",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "502fa92a71f344611101bd04ef1a595b8b6014f5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2048ec5b98dbdfe0b929d2e42dc7a54c389c53dd",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/hfs/mdb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.301",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.196",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.115",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.301",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.246",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.196",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.158",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.115",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.56",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.6",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()\n\nThe syzbot reported issue in hfs_find_set_zero_bits():\n\n=====================================================\nBUG: KMSAN: uninit-value in hfs_find_set_zero_bits+0x74d/0xb60 fs/hfs/bitmap.c:45\n hfs_find_set_zero_bits+0x74d/0xb60 fs/hfs/bitmap.c:45\n hfs_vbm_search_free+0x13c/0x5b0 fs/hfs/bitmap.c:151\n hfs_extend_file+0x6a5/0x1b00 fs/hfs/extent.c:408\n hfs_get_block+0x435/0x1150 fs/hfs/extent.c:353\n __block_write_begin_int+0xa76/0x3030 fs/buffer.c:2151\n block_write_begin fs/buffer.c:2262 [inline]\n cont_write_begin+0x10e1/0x1bc0 fs/buffer.c:2601\n hfs_write_begin+0x85/0x130 fs/hfs/inode.c:52\n cont_expand_zero fs/buffer.c:2528 [inline]\n cont_write_begin+0x35a/0x1bc0 fs/buffer.c:2591\n hfs_write_begin+0x85/0x130 fs/hfs/inode.c:52\n hfs_file_truncate+0x1d6/0xe60 fs/hfs/extent.c:494\n hfs_inode_setattr+0x964/0xaa0 fs/hfs/inode.c:654\n notify_change+0x1993/0x1aa0 fs/attr.c:552\n do_truncate+0x28f/0x310 fs/open.c:68\n do_ftruncate+0x698/0x730 fs/open.c:195\n do_sys_ftruncate fs/open.c:210 [inline]\n __do_sys_ftruncate fs/open.c:215 [inline]\n __se_sys_ftruncate fs/open.c:213 [inline]\n __x64_sys_ftruncate+0x11b/0x250 fs/open.c:213\n x64_sys_call+0xfe3/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:78\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:4154 [inline]\n slab_alloc_node mm/slub.c:4197 [inline]\n __kmalloc_cache_noprof+0x7f7/0xed0 mm/slub.c:4354\n kmalloc_noprof include/linux/slab.h:905 [inline]\n hfs_mdb_get+0x1cc8/0x2a90 fs/hfs/mdb.c:175\n hfs_fill_super+0x3d0/0xb80 fs/hfs/super.c:337\n get_tree_bdev_flags+0x6e3/0x920 fs/super.c:1681\n get_tree_bdev+0x38/0x50 fs/super.c:1704\n hfs_get_tree+0x35/0x40 fs/hfs/super.c:388\n vfs_get_tree+0xb0/0x5c0 fs/super.c:1804\n do_new_mount+0x738/0x1610 fs/namespace.c:3902\n path_mount+0x6db/0x1e90 fs/namespace.c:4226\n do_mount fs/namespace.c:4239 [inline]\n __do_sys_mount fs/namespace.c:4450 [inline]\n __se_sys_mount+0x6eb/0x7d0 fs/namespace.c:4427\n __x64_sys_mount+0xe4/0x150 fs/namespace.c:4427\n x64_sys_call+0xfa7/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:166\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 1 UID: 0 PID: 12609 Comm: syz.1.2692 Not tainted 6.16.0-syzkaller #0 PREEMPT(none)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025\n=====================================================\n\nThe HFS_SB(sb)-\u003ebitmap buffer is allocated in hfs_mdb_get():\n\nHFS_SB(sb)-\u003ebitmap = kmalloc(8192, GFP_KERNEL);\n\nFinally, it can trigger the reported issue because kmalloc()\ndoesn\u0027t clear the allocated memory. If allocated memory contains\nonly zeros, then everything will work pretty fine.\nBut if the allocated memory contains the \"garbage\", then\nit can affect the bitmap operations and it triggers\nthe reported issue.\n\nThis patch simply exchanges the kmalloc() on kzalloc()\nwith the goal to guarantee the correctness of bitmap operations.\nBecause, newly created allocation bitmap should have all\navailable blocks free. Potentially, initialization bitmap\u0027s read\noperation could not fill the whole allocated memory and\n\"garbage\" in the not initialized memory will be the reason of\nvolume coruptions and file system driver bugs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only by mounting an HFS block device or image locally and then issuing ordinary file syscalls (ftruncate/write) against it, as in the syzbot trace via `__x64_sys_ftruncate`. There is no network, adjacent-network, or remote-peer data path into `hfs_mdb_get()` or `hfs_find_set_zero_bits()`; local mounting of attacker-supplied media is routine via udisks2/automount, loop devices, and fstab `user` entries.\nAC:L - `kmalloc(8192)` never zeroes and the disk read only covers `(fs_ablocks + 8) / 8` bytes, so on every mount the tail of the bitmap object is stale slab data \u2014 the vulnerable state exists unconditionally, with no race and no memory-layout luck. Every remaining precondition is attacker-authored on-disk metadata (`drNmAlBlks`, `drClpSiz`, extent `block`/`count` feeding `goal`), the residual slab contents are groomable with standard heap-spray techniques, and the syzbot reproducer triggers it reliably.\nPR:L - hfs is registered `FS_REQUIRES_DEV` without `FS_USERNS_MOUNT`, so the mount step needs `CAP_SYS_ADMIN` in the initial namespace and is not obtainable via `unshare -Ur`; however, once a privileged automounter such as udisks2 has mounted the removable volume, an ordinary unprivileged local user drives the entire `hfs_inode_setattr \u2192 hfs_file_truncate \u2192 hfs_get_block \u2192 hfs_extend_file \u2192 hfs_vbm_search_free` path with a plain `ftruncate()`/`write()`, with no capability check anywhere along it.\nUI:N - In the removable-media/udisks2 automount scenario the crafted HFS volume is mounted without any deliberate victim action, and the trigger itself is a normal file truncate or write performed by the attacker on their own image. No action by another user or administrator is required.\nS:U - The uninitialized-memory consumption, the out-of-bounds slab access at the tail of the bitmap object, and any resulting fault all occur inside the host kernel\u0027s own security authority. No VM, hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Stale kmalloc\u0027d slab contents \u2014 potentially remnants of any prior 8 KiB kernel allocation \u2014 are consumed directly as volume allocation state and steer which blocks are handed out; the resulting run lengths and extents are persisted into on-disk metadata the attacker can read back, forming an oracle for leaked heap bytes. Because `goal` from on-disk extents is unvalidated against `fs_ablocks`, the search can also produce extents pointing past the end of the volume, causing `hfs_get_block`/`map_bh` to read device sectors outside the filesystem, and the tail write-back reads a `__be32` past the end of the kmalloc-8k object.\nI:H - The garbage bits drive `hfs_find_set_zero_bits()` to mark uninitialized regions \"used\" and return `*num_bits` exceeding the volume, underflowing `HFS_SB(sb)-\u003efree_ablocks -= *num_bits` (u32) to a huge value and installing extent records that extend past the volume end, which subsequent writes then commit to sectors outside the filesystem \u2014 exactly the \"volume corruptions\" the fix author cites. At the 64 K-bit boundary the `*curr = cpu_to_be32(n)` store at `done:` performs a 4-byte out-of-bounds read-modify-write on the slab object adjacent to the 8192-byte bitmap allocation, which per the OOB-write guidance is High.\nA:H - Consuming uninitialized memory as filesystem allocation state yields the reported KMSAN uninit-value bug plus a slab out-of-bounds access that trips KASAN/panics on hardened kernels, corrupted `free_ablocks` accounting, and extents referencing sectors beyond the volume that drive the block layer into repeated I/O failure. A persistent crafted volume retriggers the condition on every file-extension operation, at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:47.346Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fc56548fca732f3d3692c83b40db796259a03887"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf1683078fbdd09a7f7f9b74121ebaa03432bd00"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a112cdd66f5a132da5235ca31a320528c86bf33"
        },
        {
          "url": "https://git.kernel.org/stable/c/e148ed5cda8fd96d4620c4622fb02f552a2d166a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfafefcb0e1fc60135f7040f4aed0a4aef4f76ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b447fd401824e1ccf0b769188edefe866a1e676"
        },
        {
          "url": "https://git.kernel.org/stable/c/502fa92a71f344611101bd04ef1a595b8b6014f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/2048ec5b98dbdfe0b929d2e42dc7a54c389c53dd"
        }
      ],
      "title": "hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40243",
    "datePublished": "2025-12-04T15:31:32.422Z",
    "dateReserved": "2025-04-16T07:20:57.181Z",
    "dateUpdated": "2026-08-05T12:08:47.346Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40243",
      "date": "2026-09-12",
      "epss": "0.00155",
      "percentile": "0.04928"
    },
    "microsoft_vex": {
      "current_release_date": "2025-12-09T01:39:00.000Z",
      "cve": "CVE-2025-40243",
      "id": "msrc_CVE-2025-40243",
      "initial_release_date": "2025-12-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40243.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40243\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-04T16:16:17.523\",\"lastModified\":\"2026-07-30T06:24:19.710\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nhfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()\\n\\nThe syzbot reported issue in hfs_find_set_zero_bits():\\n\\n=====================================================\\nBUG: KMSAN: uninit-value in hfs_find_set_zero_bits+0x74d/0xb60 fs/hfs/bitmap.c:45\\n hfs_find_set_zero_bits+0x74d/0xb60 fs/hfs/bitmap.c:45\\n hfs_vbm_search_free+0x13c/0x5b0 fs/hfs/bitmap.c:151\\n hfs_extend_file+0x6a5/0x1b00 fs/hfs/extent.c:408\\n hfs_get_block+0x435/0x1150 fs/hfs/extent.c:353\\n __block_write_begin_int+0xa76/0x3030 fs/buffer.c:2151\\n block_write_begin fs/buffer.c:2262 [inline]\\n cont_write_begin+0x10e1/0x1bc0 fs/buffer.c:2601\\n hfs_write_begin+0x85/0x130 fs/hfs/inode.c:52\\n cont_expand_zero fs/buffer.c:2528 [inline]\\n cont_write_begin+0x35a/0x1bc0 fs/buffer.c:2591\\n hfs_write_begin+0x85/0x130 fs/hfs/inode.c:52\\n hfs_file_truncate+0x1d6/0xe60 fs/hfs/extent.c:494\\n hfs_inode_setattr+0x964/0xaa0 fs/hfs/inode.c:654\\n notify_change+0x1993/0x1aa0 fs/attr.c:552\\n do_truncate+0x28f/0x310 fs/open.c:68\\n do_ftruncate+0x698/0x730 fs/open.c:195\\n do_sys_ftruncate fs/open.c:210 [inline]\\n __do_sys_ftruncate fs/open.c:215 [inline]\\n __se_sys_ftruncate fs/open.c:213 [inline]\\n __x64_sys_ftruncate+0x11b/0x250 fs/open.c:213\\n x64_sys_call+0xfe3/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:78\\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\\n do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\nUninit was created at:\\n slab_post_alloc_hook mm/slub.c:4154 [inline]\\n slab_alloc_node mm/slub.c:4197 [inline]\\n __kmalloc_cache_noprof+0x7f7/0xed0 mm/slub.c:4354\\n kmalloc_noprof include/linux/slab.h:905 [inline]\\n hfs_mdb_get+0x1cc8/0x2a90 fs/hfs/mdb.c:175\\n hfs_fill_super+0x3d0/0xb80 fs/hfs/super.c:337\\n get_tree_bdev_flags+0x6e3/0x920 fs/super.c:1681\\n get_tree_bdev+0x38/0x50 fs/super.c:1704\\n hfs_get_tree+0x35/0x40 fs/hfs/super.c:388\\n vfs_get_tree+0xb0/0x5c0 fs/super.c:1804\\n do_new_mount+0x738/0x1610 fs/namespace.c:3902\\n path_mount+0x6db/0x1e90 fs/namespace.c:4226\\n do_mount fs/namespace.c:4239 [inline]\\n __do_sys_mount fs/namespace.c:4450 [inline]\\n __se_sys_mount+0x6eb/0x7d0 fs/namespace.c:4427\\n __x64_sys_mount+0xe4/0x150 fs/namespace.c:4427\\n x64_sys_call+0xfa7/0x3db0 arch/x86/include/generated/asm/syscalls_64.h:166\\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\\n do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\nCPU: 1 UID: 0 PID: 12609 Comm: syz.1.2692 Not tainted 6.16.0-syzkaller #0 PREEMPT(none)\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025\\n=====================================================\\n\\nThe HFS_SB(sb)-\u003ebitmap buffer is allocated in hfs_mdb_get():\\n\\nHFS_SB(sb)-\u003ebitmap = kmalloc(8192, GFP_KERNEL);\\n\\nFinally, it can trigger the reported issue because kmalloc()\\ndoesn\u0027t clear the allocated memory. If allocated memory contains\\nonly zeros, then everything will work pretty fine.\\nBut if the allocated memory contains the \\\"garbage\\\", then\\nit can affect the bitmap operations and it triggers\\nthe reported issue.\\n\\nThis patch simply exchanges the kmalloc() on kzalloc()\\nwith the goal to guarantee the correctness of bitmap operations.\\nBecause, newly created allocation bitmap should have all\\navailable blocks free. Potentially, initialization bitmap\u0027s read\\noperation could not fill the whole allocated memory and\\n\\\"garbage\\\" in the not initialized memory will be the reason of\\nvolume coruptions and file system driver bugs.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/hfs/mdb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"fc56548fca732f3d3692c83b40db796259a03887\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"bf1683078fbdd09a7f7f9b74121ebaa03432bd00\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"2a112cdd66f5a132da5235ca31a320528c86bf33\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"e148ed5cda8fd96d4620c4622fb02f552a2d166a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"cfafefcb0e1fc60135f7040f4aed0a4aef4f76ca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"3b447fd401824e1ccf0b769188edefe866a1e676\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"502fa92a71f344611101bd04ef1a595b8b6014f5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"2048ec5b98dbdfe0b929d2e42dc7a54c389c53dd\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/hfs/mdb.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.301\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.246\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.196\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.158\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.115\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.56\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.6\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2048ec5b98dbdfe0b929d2e42dc7a54c389c53dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2a112cdd66f5a132da5235ca31a320528c86bf33\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3b447fd401824e1ccf0b769188edefe866a1e676\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/502fa92a71f344611101bd04ef1a595b8b6014f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bf1683078fbdd09a7f7f9b74121ebaa03432bd00\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cfafefcb0e1fc60135f7040f4aed0a4aef4f76ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e148ed5cda8fd96d4620c4622fb02f552a2d166a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fc56548fca732f3d3692c83b40db796259a03887\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:34:28+00:00",
      "cve": "CVE-2025-40243",
      "id": "CVE-2025-40243",
      "initial_release_date": "2025-12-04T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40243.json",
      "version": "3"
    }
  }
}