CVE-2025-40351
Uninitialized Value Vulnerability in Linux Kernel HFS+ Filesystem
Publication date: 2025-12-16
Last updated on: 2025-12-16
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for KMSAN (Kernel Memory Sanitizer) uninitialized value warnings related to the hfsplus filesystem, specifically messages mentioning hfsplus_subfolders_dec, hfsplus_delete_cat, or related functions. You can check the kernel log using commands like 'dmesg | grep -i kmsan' or 'journalctl -k | grep -i kmsan' to find such error messages.
Can you explain this vulnerability to me?
This vulnerability is an uninitialized value issue in the Linux kernel's HFS+ filesystem implementation, specifically in the function hfsplus_delete_cat(). It was detected by the Kernel Memory Sanitizer (KMSAN) and involves uninitialized memory being used in the hfsplus_subfolders_dec function, which can lead to undefined behavior or kernel panic.
How can this vulnerability impact me? :
The impact of this vulnerability could include kernel instability or crashes (kernel panic) when performing operations on HFS+ filesystems, such as deleting directories. This could lead to denial of service or system instability for users relying on the affected filesystem.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the hfsplus KMSAN uninitialized value issue in hfsplus_delete_cat() has been fixed. Until the update is applied, avoid using the hfsplus filesystem or unmount any hfsplus filesystems to prevent triggering the vulnerability.