CVE-2025-71271
Awaiting Analysis Awaiting Analysis - Queue
Memory Leak in Linux Kernel HFS+ Filesystem

Publication date: 2026-05-06

Last updated on: 2026-05-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: hfsplus: ensure sb->s_fs_info is always cleaned up When hfsplus was converted to the new mount api a bug was introduced by changing the allocation pattern of sb->s_fs_info. If setup_bdev_super() fails after a new superblock has been allocated by sget_fc(), but before hfsplus_fill_super() takes ownership of the filesystem-specific s_fs_info data it was leaked. Fix this by freeing sb->s_fs_info in hfsplus_kill_super().
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-06
Last Modified
2026-05-06
Generated
2026-06-16
AI Q&A
2026-05-06
EPSS Evaluated
2026-06-15
NVD
CVE-2025-71271
EUVD
EUVD-2025-209671
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel hfsplus *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

The vulnerability in the Linux kernel related to hfsplus has been resolved by ensuring that sb->s_fs_info is always cleaned up properly. To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix where sb->s_fs_info is freed in hfsplus_kill_super().

Executive Summary

This vulnerability exists in the Linux kernel's hfsplus filesystem implementation. When hfsplus was updated to use a new mount API, a bug was introduced in how the filesystem-specific data (sb->s_fs_info) was allocated and managed. Specifically, if the function setup_bdev_super() fails after a new superblock is allocated but before hfsplus_fill_super() takes ownership of the filesystem-specific data, the sb->s_fs_info data is leaked because it is not properly freed.

The fix involves ensuring that sb->s_fs_info is always cleaned up by freeing it in the hfsplus_kill_super() function to prevent this memory leak.

Impact Analysis

This vulnerability can lead to a memory leak in the Linux kernel when mounting hfsplus filesystems. Over time, repeated failures in mounting could cause increased memory consumption, potentially degrading system performance or leading to resource exhaustion.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71271. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart