LiveActive security incident?Get immediate response
CVE Record

CVE-2025-68767: hfsplus: Verify inode mode when loading from disk

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Verify inode mode when loading from disk syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 16bits "mode" field loaded from disk are corrupted. According to [1], the permissions field was treated as reserved in Mac OS 8 and 9. According to [2], the reserved field was explicitly initialized with 0, and that field must remain 0 as long as reserved. Therefore, when the "mode" field is not 0 (i.e. no longer reserved), the file must be S_IFDIR if dir == 1, and the file must be one of S_IFREG/S_IFLNK/S_IFCHR/ S_IFBLK/S_IFIFO/S_IFSOCK if dir == 0.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects HFS+ filesystem handling. A corrupted on-disk inode mode value could be accepted with invalid file-type bits. The public record does not provide CVSS, impact detail, or evidence of exploitation, so urgency depends on whether systems mount HFS+ media or images.

Executive priority

Track and patch through normal kernel maintenance unless HFS+ mounting is business-critical or accepts untrusted media. Escalate patching for systems processing external disk images or removable storage.

Technical view

The hfsplus code loaded inode->i_mode from disk without verifying S_IFMT bits against the directory flag and allowed file types. The fix validates that nonzero mode fields map to S_IFDIR for directories or expected non-directory file types.

Likely exposure

Exposure is most relevant to Linux systems that enable and mount HFS+ filesystems, particularly removable media, disk images, or other externally supplied HFS+ volumes. Systems that never mount HFS+ are less likely to be exposed.

Exploitation context

CISA KEV status is false in the provided bundle, and no cited source states active exploitation. The record points to syzbot discovery and kernel stable fixes, but does not describe real-world attacks or exploit reliability.

Researcher notes

Evidence is limited: no CVSS, CWE, or explicit impact classification is provided. The root issue is validation of corrupted on-disk mode bits in hfsplus inode loading. Analyze reachable mount scenarios before assigning higher operational severity.

Mitigation direction

  • Update Linux kernels using distribution guidance or referenced stable fixes.
  • Prioritize systems that mount HFS+ media or disk images.
  • Avoid mounting untrusted HFS+ volumes until patched.
  • Check vendor advisories for supported package versions.

Validation and detection

  • Inventory hosts with HFS+ filesystem support enabled or loaded.
  • Identify workflows that mount HFS+ removable media or images.
  • Compare running kernel packages with vendor fixed versions.
  • Review change control for deployment of referenced stable commits.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-68767 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2unaffected
LinuxLinux2.6.12, 0, 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, 6.18.3, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.