CVE-2025-38712 – A vulnerability in the Linux kernel's HFS+ file... (How to Fix)

Q: What is the severity of CVE-2025-38712?

CVE-2025-38712 has a CVSS score of 5.5 (MEDIUM). A vulnerability in the Linux kernel's HFS+ filesystem driver where erroneous volume header values cause the system to incorrectly assume the attributes file doesn't exist, leading to a kernel panic via BUG_ON() when attempting to create it. This affects systems using HFS+ filesystems, primarily Linux servers and workstations. The vulnerability can cause denial of service but doesn't allow arbitrary code execution.

📋 TL;DR

A vulnerability in the Linux kernel's HFS+ filesystem driver where erroneous volume header values cause the system to incorrectly assume the attributes file doesn't exist, leading to a kernel panic via BUG_ON() when attempting to create it. This affects systems using HFS+ filesystems, primarily Linux servers and workstations. The vulnerability can cause denial of service but doesn't allow arbitrary code execution.

💻 Affected Systems

Products:

Linux kernel

Versions: Versions containing vulnerable hfsplus driver code before patches were applied

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with HFS+ filesystem support compiled into kernel or loaded as module, and when mounting HFS+ volumes.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, requiring physical or remote console access to reboot.

🟠

Likely Case

System crash when mounting a corrupted HFS+ filesystem, requiring reboot to restore service.

🟢

If Mitigated

System returns -EIO error with suggestion to run fsck, preventing crash but causing mount failure.

🌐 Internet-Facing: LOW - Requires mounting HFS+ filesystems, which is uncommon for internet-facing services.

🏢 Internal Only: MEDIUM - Internal systems mounting HFS+ filesystems (e.g., from macOS backups or external drives) could experience crashes.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to mount a specially crafted HFS+ filesystem with corrupted volume header. No remote exploitation vector identified.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 03cd1db1494cf930e2fa042c9c13e32bffdb4eba, 1bb8da27ff15e346d4bc9e248e819c9a88ebf9d6, 9046566fa692f88954dac8c510f37ee17a15fdb7, b3359392b75395a31af739a761f48f4041148226, bb0eea8e375677f586ad11c12e2525ed3fc698c2

Vendor Advisory: https://git.kernel.org/stable/c/03cd1db1494cf930e2fa042c9c13e32bffdb4eba

Restart Required: No

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. For custom kernels: apply the relevant commits from kernel git repository. 3. No reboot required if using kernel live patching (kpatch/kgraft).

🔧 Temporary Workarounds

Disable HFS+ module

all

Prevent loading of hfsplus kernel module to eliminate attack surface

echo 'blacklist hfsplus' >> /etc/modprobe.d/blacklist.conf
rmmod hfsplus

Avoid mounting HFS+ filesystems

all

Do not mount HFS+ volumes from untrusted sources

🧯 If You Can't Patch

Ensure HFS+ filesystems are only mounted from trusted sources
Implement monitoring for kernel panic/crash events related to filesystem operations

🔍 How to Verify

Check if Vulnerable:

Check if hfsplus module is loaded: lsmod | grep hfsplus AND check kernel version against patched versions

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits or test by attempting to mount a test HFS+ filesystem with corrupted header (not recommended in production)

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages containing 'BUG:' or 'hfsplus'
System crash/reboot events after mounting filesystems
Filesystem mount errors with HFS+ volumes

Network Indicators:

None - local filesystem vulnerability

SIEM Query:

event.source="kernel" AND (message:"BUG:" OR message:"hfsplus" OR message:"kernel panic")

📊 Metadata

CVE ID: CVE-2025-38712

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-617

EPSS Score: 0.01% exploit probability (1.6th percentile)

Published: September 4, 2025

Last Updated: January 27, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-38712, you might also want to check these: