Security readout for executives and security teams
Plain-English summary
A Linux HFS+ filesystem flaw can read beyond an allocated kernel memory object during file deletion processing. Because kernel memory corruption can affect confidentiality, integrity, and availability, exposed systems should receive a corrected vendor kernel promptly. The supplied evidence does not establish remote reachability or active exploitation.
Executive priority
Treat as a high-priority kernel update for systems that use or may process HFS+ content. Accelerate remediation on multi-user or media-processing systems. Lower the priority only after confirming HFS+ is unavailable and vendor assessment shows the installed kernel is unaffected.
Technical view
CVE-2025-38714 is a slab-out-of-bounds read in hfsplus_bnode_read(), observed by KASAN while unlinking an HFS+ object and deleting attributes. The supplied CVSS 3.1 score is 7.8: local access, low complexity, low privileges, no user interaction, with high confidentiality, integrity, and availability impacts.
Likely exposure
Exposure is most likely where an affected Linux kernel supports and processes HFS+ filesystems. Systems that never mount or otherwise use HFS+ have lower practical exposure. The supplied version data is ambiguous, so confirm affected and corrected package versions with the Linux distribution or appliance vendor.
Exploitation context
The supplied record is not marked as CISA KEV and provides no evidence of active exploitation. Its CVSS vector describes a local, low-privileged attack path. A sanitizer-triggering reproducer exists, but the bundle does not establish reliable privilege escalation, data theft, or remote exploitation.
Researcher notes
The trace records an eight-byte out-of-bounds read in hfsplus_bnode_read(), reached through attribute deletion and unlink handling. Stable-tree fixes are referenced across multiple branches. The bundle is truncated and contains unclear version entries; researchers should use commit ancestry and vendor package mappings instead of interpreting every listed version as a release boundary.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable HFS+ correction.
- Check distribution or appliance advisories for exact corrected package versions.
- Until patched, restrict untrusted users and services from mounting or processing HFS+ media.
- Prioritize shared hosts, appliances, and systems accepting removable or uploaded filesystem images.
Validation and detection
- Inventory kernel versions and identify systems where HFS+ support is available or loaded.
- Review mount configuration and telemetry for current or historical HFS+ filesystem use.
- Map installed packages against vendor advisories and applicable Linux stable fix commits.
- After updating, verify the corrected kernel is running following any required reboot.
- Monitor kernel logs for HFS+ faults, KASAN reports, crashes, or unexpected reboots.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38714 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/032f7ed6717a4cd3714f9801be39fdfc7f1c7644CVE reference, Linux
- https://git.kernel.org/stable/c/ffee8a7bed0fbfe29da239a922b59c5db897c613CVE reference, Linux
- https://git.kernel.org/stable/c/5ab59229bef6063edf3a6fc2e3e3fd7cd2181b29CVE reference, Linux
- https://git.kernel.org/stable/c/a2abd574d2fe22b8464cf6df5abb6f24d809eac0CVE reference, Linux
- https://git.kernel.org/stable/c/8583d067ae22b7f32ce5277ca5543ac8bf86a3e5CVE reference, Linux
- https://git.kernel.org/stable/c/475d770c19929082aab43337e6c077d0e2043df3CVE reference, Linux
- https://git.kernel.org/stable/c/291b7f2538920aa229500dbdd6c5f0927a51bc8bCVE reference, Linux
- https://git.kernel.org/stable/c/7fa4cef8ea13b37811287ef60674c5fd1dd02ee6CVE reference, Linux
- https://git.kernel.org/stable/c/c80aa2aaaa5e69d5219c6af8ef7e754114bd08d2CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.