CVE-2025-38715

Q: What is the severity of CVE-2025-38715?

CVE-2025-38715 has a CVSS score of 7.1 (HIGH). A slab-out-of-bounds memory access vulnerability in the Linux kernel's HFS filesystem implementation allows attackers to read or write beyond allocated memory boundaries. This affects Linux systems using the HFS filesystem driver. The vulnerability could lead to system crashes or potential privilege escalation.

7.1 HIGH

Denial of Service

📋 TL;DR

A slab-out-of-bounds memory access vulnerability in the Linux kernel's HFS filesystem implementation allows attackers to read or write beyond allocated memory boundaries. This affects Linux systems using the HFS filesystem driver. The vulnerability could lead to system crashes or potential privilege escalation.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE, but likely multiple stable kernel versions before the fix commits.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when HFS filesystem is mounted or accessed. Many Linux systems don't use HFS by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to denial of service, or potential privilege escalation if combined with other vulnerabilities to achieve arbitrary code execution.

🟠

Likely Case

System crash or kernel panic causing denial of service, potentially leading to data corruption in HFS filesystems.

🟢

If Mitigated

No impact if HFS filesystem is not mounted or if the patch is applied.

🌐 Internet-Facing: LOW - Requires local access or ability to mount HFS filesystems.

🏢 Internal Only: MEDIUM - Local users or processes with HFS access could trigger crashes.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to trigger HFS filesystem operations with malicious offset/length parameters.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits 384a66b89f9540a9a8cb0f48807697dfabaece4c and related fixes

Vendor Advisory: https://git.kernel.org/stable/c/384a66b89f9540a9a8cb0f48807697dfabaece4c

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable HFS module

linux

Prevent loading of HFS kernel module to eliminate attack surface

echo 'install hfs /bin/false' >> /etc/modprobe.d/disable-hfs.conf
rmmod hfs

Avoid HFS mounts

linux

Ensure no HFS filesystems are mounted on the system

umount /dev/sdX (if HFS)
check /etc/fstab for HFS entries

🧯 If You Can't Patch

Disable HFS kernel module using modprobe blacklisting
Implement strict access controls to prevent untrusted users from mounting filesystems

🔍 How to Verify

Check if Vulnerable:

Check if HFS module is loaded: lsmod | grep hfs. Check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits. Check that HFS operations don't crash with boundary tests.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
Oops messages in dmesg
Slab corruption warnings

Network Indicators:

None - local vulnerability

SIEM Query:

source="kernel" AND ("Oops" OR "panic" OR "slab") AND ("hfs" OR "bnode")

📊 Metadata

CVE ID: CVE-2025-38715

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-125

EPSS Score: 0.01% exploit probability (2.4th percentile)

Published: September 4, 2025

Last Updated: January 27, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable HFS module

Avoid HFS mounts

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities