Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw affects HFS+ filesystem handling. A local, low-privileged user may be able to trigger an out-of-bounds memory read during filename comparison, potentially exposing kernel data or crashing the system. Risk is concentrated on systems that use HFS+ volumes; systems without active HFS+ support have substantially lower practical exposure.
Executive priority
Treat this as a focused high-priority kernel update, not an internet-wide emergency. Patch HFS+-using and shared Linux systems promptly through normal kernel maintenance. Accelerate remediation where untrusted local users or media can reach HFS+ operations. Current sources do not support an active-exploitation claim.
Technical view
CVE-2025-40088 is a two-byte slab-out-of-bounds read in Linux hfsplus_strcasecmp(), reached during catalog-key comparison and pathname lookup. KASAN demonstrated the fault on 6.17.0-rc6. Its CVSS 3.1 score is 7.1: local, low complexity, low privileges, no user interaction, with potential confidentiality and availability impacts. Stable kernel commits resolve the defect.
Likely exposure
Most likely exposed are Linux hosts running an affected or unpatched vendor kernel with HFS+ support actively used to access HFS+ volumes. Exposure is lower where HFS+ is unavailable, disabled, or unused. The bundle mixes version labels and commit identifiers, so confirm status using distributor advisories and backport records.
Exploitation context
The supplied record is not in KEV and provides no evidence of active exploitation or a public weaponized exploit. Its CVSS vector describes a local, low-complexity, low-privilege path requiring no user interaction. The included KASAN result proves the memory-safety defect but does not establish real-world exploitation.
Researcher notes
The defect is an out-of-bounds two-byte slab read in case-insensitive HFS+ name comparison, observed through catalog lookup and pathname resolution. The record assigns confidentiality and availability impacts, but no integrity impact. Resolve exact vulnerable and fixed ranges per stable branch or distributor backport; the supplied affected-version list is insufficiently clear for version-only detection.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable listed stable fix, then reboot into that kernel.
- Confirm remediation through the distribution's advisory or backport record; version strings alone may be misleading.
- Where immediate patching is impossible, follow vendor guidance and reduce unnecessary HFS+ use until remediation.
- Prioritize shared systems and hosts that routinely mount or process HFS+ volumes.
Validation and detection
- Record the running kernel release and package build on every Linux host.
- Determine whether HFS+ support is present and whether HFS+ volumes are mounted or routinely processed.
- Map each vendor kernel build to an advisory or one of the supplied stable fix commits.
- After updating, verify the host rebooted into the remediated kernel and repeat exposure checks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-40088 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/603158d4efa98a13a746bd586c20f194f4a31ec8CVE reference, Linux
- https://git.kernel.org/stable/c/ef250c3edd995d7bb5a5e5122ffad1c28a8686ebCVE reference, Linux
- https://git.kernel.org/stable/c/7ab44236b32ed41eb0636797e8e8e885a2f3b18aCVE reference, Linux
- https://git.kernel.org/stable/c/b47a75b6f762321f9eb6f31aab7bce47a37063b7CVE reference, Linux
- https://git.kernel.org/stable/c/4f5ab4a9c6abd8b0d713cc2b7b041bc10d70f241CVE reference, Linux
- https://git.kernel.org/stable/c/586c75dfd1d265c4150f6529debb85c9d62e101fCVE reference, Linux
- https://git.kernel.org/stable/c/4bc081ba6c52b0c88c92701e3fbc33c7e2277afbCVE reference, Linux
- https://git.kernel.org/stable/c/42520df65bf67189541a425f7d36b0b3e7bd7844CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.