CVE-2025-38713

Q: What is the severity of CVE-2025-38713?

CVE-2025-38713 has a CVSS score of 7.1 (HIGH). This is a memory corruption vulnerability in the Linux kernel's HFS+ filesystem driver. A slab-out-of-bounds read in the hfsplus_uni2asc() function can be triggered via hfsplus_readdir(), potentially leading to kernel crashes or information disclosure. Systems using HFS+ filesystems with affected Linux kernel versions are vulnerable.

7.1 HIGH

Denial of Service

📋 TL;DR

This is a memory corruption vulnerability in the Linux kernel's HFS+ filesystem driver. A slab-out-of-bounds read in the hfsplus_uni2asc() function can be triggered via hfsplus_readdir(), potentially leading to kernel crashes or information disclosure. Systems using HFS+ filesystems with affected Linux kernel versions are vulnerable.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not provided in CVE, but references indicate fixes in stable kernel trees. Likely affects multiple kernel versions before fixes.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with HFS+ filesystem support compiled into kernel or loaded as module, and when HFS+ filesystems are mounted.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, denial of service, or potential information disclosure of kernel memory contents.

🟠

Likely Case

System crash or kernel panic when reading directories on HFS+ filesystems, causing denial of service.

🟢

If Mitigated

Limited impact if HFS+ filesystems are not mounted or accessed.

🌐 Internet-Facing: LOW - Requires local filesystem access, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local users or processes accessing HFS+ filesystems can trigger crashes.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW - Triggered by normal filesystem operations on HFS+.

Exploitation requires ability to trigger hfsplus_readdir() on vulnerable HFS+ filesystems.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel commits provided in references (e.g., 13604b1d7e7b125fb428cddbec6b8d92baad25d5)

Vendor Advisory: https://git.kernel.org/stable/c/13604b1d7e7b125fb428cddbec6b8d92baad25d5

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable HFS+ module

linux

Prevent loading of HFS+ filesystem driver if not needed.

echo 'install hfsplus /bin/false' >> /etc/modprobe.d/disable-hfsplus.conf
rmmod hfsplus 2>/dev/null || true

Avoid HFS+ mounts

linux

Do not mount HFS+ filesystems until patched.

🧯 If You Can't Patch

Restrict access to HFS+ filesystems to trusted users only
Monitor for kernel panic/crash events related to HFS+ operations

🔍 How to Verify

Check if Vulnerable:

Check if HFS+ module is loaded: lsmod | grep hfsplus. Check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version after update matches patched version. Test reading HFS+ directories if safe.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
KASAN reports of slab-out-of-bounds in hfsplus_uni2asc
System crashes during directory operations

SIEM Query:

kernel:panic OR kernel:BUG: KASAN: slab-out-of-bounds AND hfsplus

📊 Metadata

CVE ID: CVE-2025-38713

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-125

EPSS Score: 0.01% exploit probability (2.4th percentile)

Published: September 4, 2025

Last Updated: January 27, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable HFS+ module

Avoid HFS+ mounts

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities