LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38650: hfsplus: remove mutex_lock check in hfsplus_free_extents

In the Linux kernel, the following vulnerability has been resolved: hfsplus: remove mutex_lock check in hfsplus_free_extents Syzbot reported an issue in hfsplus filesystem: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 4400 at fs/hfsplus/extents.c:346 hfsplus_free_extents+0x700/0xad0 Call Trace: <TASK> hfsplus_file_truncate+0x768/0xbb0 fs/hfsplus/extents.c:606 hfsplus_write_begin+0xc2/0xd0 fs/hfsplus/inode.c:56 cont_expand_zero fs/buffer.c:2383 [inline] cont_write_begin+0x2cf/0x860 fs/buffer.c:2446 hfsplus_write_begin+0x86/0xd0 fs/hfsplus/inode.c:52 generic_cont_expand_simple+0x151/0x250 fs/buffer.c:2347 hfsplus_setattr+0x168/0x280 fs/hfsplus/inode.c:263 notify_change+0xe38/0x10f0 fs/attr.c:420 do_truncate+0x1fb/0x2e0 fs/open.c:65 do_sys_ftruncate+0x2eb/0x380 fs/open.c:193 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd To avoid deadlock, Commit 31651c607151 ("hfsplus: avoid deadlock on file truncation") unlock extree before hfsplus_free_extents(), and add check wheather extree is locked in hfsplus_free_extents(). However, when operations such as hfsplus_file_release, hfsplus_setattr, hfsplus_unlink, and hfsplus_get_block are executed concurrently in different files, it is very likely to trigger the WARN_ON, which will lead syzbot and xfstest to consider it as an abnormality. The comment above this warning also describes one of the easy triggering situations, which can easily trigger and cause xfstest&syzbot to report errors. [task A] [task B] ->hfsplus_file_release ->hfsplus_file_truncate ->hfs_find_init ->mutex_lock ->mutex_unlock ->hfsplus_write_begin ->hfsplus_get_block ->hfsplus_file_extend ->hfsplus_ext_read_extent ->hfs_find_init ->mutex_lock ->hfsplus_free_extents WARN_ON(mutex_is_locked) !!! Several threads could try to lock the shared extents tree. And warning can be triggered in one thread when another thread has locked the tree. This is the wrong behavior of the code and we need to remove the warning.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2025-38650 is a Linux kernel HFS+ filesystem issue where concurrent file operations can trigger an incorrect kernel warning. The source describes testing failures from syzbot and xfstest, not confirmed compromise. Business urgency is mainly for systems that mount HFS+ volumes or run kernel validation pipelines.

Executive priority

Treat as routine kernel maintenance unless HFS+ is operationally important in your environment. Prioritize affected servers, test infrastructure, and systems handling untrusted removable media, but current sources do not support emergency response.

Technical view

In hfsplus_free_extents, a WARN_ON mutex check could fire when another thread legitimately held the shared extents tree lock. Concurrent hfsplus_file_release, setattr, unlink, write_begin, or get_block paths can trigger the warning. The kernel fix removes the incorrect lock-state warning.

Likely exposure

Exposure appears limited to Linux systems using the HFS+ filesystem code path, especially systems mounting, modifying, or testing HFS+ volumes on affected kernel builds. The bundle does not identify remote exposure, privilege escalation, data theft, or broad default exposure.

Exploitation context

The bundle cites syzbot and xfstest triggering an abnormal warning through concurrent filesystem operations. It does not cite active exploitation, a public exploit, KEV listing, or a demonstrated security impact beyond incorrect warning behavior.

Researcher notes

The important distinction is that the warning was logically wrong under cross-file concurrency. The record describes a false abnormal condition caused by shared extents-tree locking, resolved by removing the WARN_ON rather than changing a published exploitation primitive.

Mitigation direction

  • Apply vendor kernel updates that include the referenced stable HFS+ fix.
  • For Debian systems, review the cited Debian LTS advisories for packaged kernel guidance.
  • Reduce unnecessary HFS+ mounting on systems awaiting kernel updates.
  • Track kernel vendor advisories because the bundle provides no separate workaround.

Validation and detection

  • Inventory Linux hosts that mount or enable HFS+ filesystem support.
  • Compare running kernel builds against vendor advisories and the referenced stable commits.
  • Check kernel logs for HFS+ warnings during concurrent file operations.
  • Confirm updated kernels contain the hfsplus_free_extents warning removal.
Prepared
Confidence
high
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38650 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
12Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux31651c607151f1034cfb57e5a78678bea54c362b, 31651c607151f1034cfb57e5a78678bea54c362b, 31651c607151f1034cfb57e5a78678bea54c362b, 31651c607151f1034cfb57e5a78678bea54c362b, 31651c607151f1034cfb57e5a78678bea54c362b, 31651c607151f1034cfb57e5a78678bea54c362b, 31651c607151f1034cfb57e5a78678bea54c362b, 31651c607151f1034cfb57e5a78678bea54c362b, 31651c607151f1034cfb57e5a78678bea54c362bunaffected
LinuxLinux4.19, 0, 5.4.297, 5.10.241, 5.15.190, 6.1.148, 6.6.102, 6.12.42, 6.15.10, 6.16.1, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.