LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38715: hfs: fix slab-out-of-bounds in hfs_bnode_read()

In the Linux kernel, the following vulnerability has been resolved: hfs: fix slab-out-of-bounds in hfs_bnode_read() This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfs_bnode_read(), hfs_bnode_write(), hfs_bnode_clear(), hfs_bnode_copy(), and hfs_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux HFS filesystem flaw can access memory outside an allocated kernel object when processing invalid offsets or lengths. The source explicitly identifies kernel crashes; its CVSS assessment also indicates possible confidentiality, integrity, and availability impact. Exploitation requires local, low-privileged access and no user interaction.

Executive priority

Treat this as a high-priority kernel update, especially for multi-user systems or environments using HFS. It is not presented as an internet-wide emergency because access is local and active exploitation is unconfirmed. Accelerate remediation where untrusted users or workloads can reach HFS functionality.

Technical view

The flaw is a slab-out-of-bounds condition in HFS b-node handling. The kernel fix validates requested offsets and corrects unsafe lengths across hfs_bnode_read(), write(), clear(), copy(), and move(). It is rated CVSS 3.1 7.8 with local access, low complexity, low privileges, and high potential impact.

Likely exposure

Exposure is concentrated on Linux systems running affected kernels where HFS filesystem functionality is enabled, loadable, or used. Multi-user systems and workflows handling HFS media deserve priority. Systems that do not use HFS may have lower practical exposure, but configuration and vendor package status must be verified.

Exploitation context

The supplied record is not in CISA KEV and provides no evidence of active exploitation or a public exploit. The CVSS vector describes a local, low-privileged attack without user interaction, not an unauthenticated remote compromise. The precise path for reaching vulnerable HFS operations is not documented in the supplied description.

Researcher notes

Version metadata mixes a foundational commit hash with release values and may not represent vendor backports cleanly. Validate exposure using vendor advisories and referenced stable commits. The description explicitly supports out-of-bounds access and crashes; broader confidentiality and integrity consequences come from the supplied CVSS vector rather than a documented exploitation outcome.

Mitigation direction

  • Apply vendor-supported kernel updates containing the HFS offset and length validation fixes.
  • Prioritize systems using HFS or permitting low-privileged local access.
  • Follow distribution or appliance guidance for exact fixed package versions and update activation requirements.
  • If patching is delayed, reduce unnecessary HFS exposure according to vendor guidance.

Validation and detection

  • Inventory running kernel versions and vendor kernel packages across Linux assets.
  • Determine whether HFS support is enabled, loadable, or used in operational workflows.
  • Confirm deployed source or vendor packages incorporate a referenced stable kernel fix.
  • After updating, verify the active kernel is the vendor-fixed version.
  • Monitor affected systems for HFS-related kernel crashes or memory-safety reports.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38715 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
13Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-38715Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2unaffected
LinuxLinux2.6.12, 0, 5.4.297, 5.10.241, 5.15.190, 6.1.149, 6.6.103, 6.12.43, 6.15.11, 6.16.2, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.