CVE-2025-40244

hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()

State: Published
Severity: 7.8 High
Published: Dec 4, 2025
Updated: Aug 5, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()

The syzbot reported issue in __hfsplus_ext_cache_extent():

[ 70.194323][ T9350] BUG: KMSAN: uninit-value in __hfsplus_ext_cache_extent+0x7d0/0x990 [ 70.195022][ T9350] __hfsplus_ext_cache_extent+0x7d0/0x990 [ 70.195530][ T9350] hfsplus_file_extend+0x74f/0x1cf0 [ 70.195998][ T9350] hfsplus_get_block+0xe16/0x17b0 [ 70.196458][ T9350] __block_write_begin_int+0x962/0x2ce0 [ 70.196959][ T9350] cont_write_begin+0x1000/0x1950 [ 70.197416][ T9350] hfsplus_write_begin+0x85/0x130 [ 70.197873][ T9350] generic_perform_write+0x3e8/0x1060 [ 70.198374][ T9350] __generic_file_write_iter+0x215/0x460 [ 70.198892][ T9350] generic_file_write_iter+0x109/0x5e0 [ 70.199393][ T9350] vfs_write+0xb0f/0x14e0 [ 70.199771][ T9350] ksys_write+0x23e/0x490 [ 70.200149][ T9350] __x64_sys_write+0x97/0xf0 [ 70.200570][ T9350] x64_sys_call+0x3015/0x3cf0 [ 70.201065][ T9350] do_syscall_64+0xd9/0x1d0 [ 70.201506][ T9350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.202054][ T9350] [ 70.202279][ T9350] Uninit was created at: [ 70.202693][ T9350] __kmalloc_noprof+0x621/0xf80 [ 70.203149][ T9350] hfsplus_find_init+0x8d/0x1d0 [ 70.203602][ T9350] hfsplus_file_extend+0x6ca/0x1cf0 [ 70.204087][ T9350] hfsplus_get_block+0xe16/0x17b0 [ 70.204561][ T9350] __block_write_begin_int+0x962/0x2ce0 [ 70.205074][ T9350] cont_write_begin+0x1000/0x1950 [ 70.205547][ T9350] hfsplus_write_begin+0x85/0x130 [ 70.206017][ T9350] generic_perform_write+0x3e8/0x1060 [ 70.206519][ T9350] __generic_file_write_iter+0x215/0x460 [ 70.207042][ T9350] generic_file_write_iter+0x109/0x5e0 [ 70.207552][ T9350] vfs_write+0xb0f/0x14e0 [ 70.207961][ T9350] ksys_write+0x23e/0x490 [ 70.208375][ T9350] __x64_sys_write+0x97/0xf0 [ 70.208810][ T9350] x64_sys_call+0x3015/0x3cf0 [ 70.209255][ T9350] do_syscall_64+0xd9/0x1d0 [ 70.209680][ T9350] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.210230][ T9350] [ 70.210454][ T9350] CPU: 2 UID: 0 PID: 9350 Comm: repro Not tainted 6.12.0-rc5 #5 [ 70.211174][ T9350] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.212115][ T9350] ===================================================== [ 70.212734][ T9350] Disabling lock debugging due to kernel taint [ 70.213284][ T9350] Kernel panic - not syncing: kmsan.panic set ... [ 70.213858][ T9350] CPU: 2 UID: 0 PID: 9350 Comm: repro Tainted: G B 6.12.0-rc5 #5 [ 70.214679][ T9350] Tainted: [B]=BAD_PAGE [ 70.215057][ T9350] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.215999][ T9350] Call Trace: [ 70.216309][ T9350] <TASK> [ 70.216585][ T9350] dump_stack_lvl+0x1fd/0x2b0 [ 70.217025][ T9350] dump_stack+0x1e/0x30 [ 70.217421][ T9350] panic+0x502/0xca0 [ 70.217803][ T9350] ? kmsan_get_metadata+0x13e/0x1c0

[ 70.218294][ Message fromT sy9350] kmsan_report+0x296/slogd@syzkaller 0x2aat Aug 18 22:11:058 ... kernel :[ 70.213284][ T9350] Kernel panic - not syncing: kmsan.panic [ 70.220179][ T9350] ? kmsan_get_metadata+0x13e/0x1c0 set ... [ 70.221254][ T9350] ? __msan_warning+0x96/0x120 [ 70.222066][ T9350] ? __hfsplus_ext_cache_extent+0x7d0/0x990 [ 70.223023][ T9350] ? hfsplus_file_extend+0x74f/0x1cf0 [ 70.224120][ T9350] ? hfsplus_get_block+0xe16/0x17b0 [ 70.224946][ T9350] ? __block_write_begin_int+0x962/0x2ce0 [ 70.225756][ T9350] ? cont_write_begin+0x1000/0x1950 [ 70.226337][ T9350] ? hfsplus_write_begin+0x85/0x130 [ 70.226852][ T9350] ? generic_perform_write+0x3e8/0x1060 [ 70.227405][ T9350] ? __generic_file_write_iter+0x215/0x460 [ 70.227979][ T9350] ? generic_file_write_iter+0x109/0x5e0 [ 70.228540][ T9350] ? vfs_write+0xb0f/0x14e0 [ 70.228997][ T9350] ? ksys_write+0x23e/0x490 ---truncated---

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c1ec90bed504640a42bb20a5f413be39cd17ad71Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b8a72692aa42b7dcd179a96b90bc2763ac74576aAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c135b8dca65526aa5b8814e9954e0ae317d9c598Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d7e313039a8f3a6ee072dc5ff4643234d2d735cfAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a5bfb13b4f406aef1a450f99d22d3e48df01528cAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 99202d94909d323a30d154ab0261c0a07166daecAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 14c673a2f3ecf650b694a52a88688f1d71849899Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4840ceadef4290c56cc422f0fc697655f3cbf070Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.4.301 through 5.4.Not affected 5.10.246 through 5.10.Not affected 5.15.196 through 5.15.Not affected 6.1.158 through 6.1.Not affected 6.6.115 through 6.6.Not affected 6.12.56 through 6.12.Not affected 6.17.6 through 6.17.*Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c1ec90bed504640a42bb20a5f413be39cd17ad71Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b8a72692aa42b7dcd179a96b90bc2763ac74576aAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c135b8dca65526aa5b8814e9954e0ae317d9c598Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d7e313039a8f3a6ee072dc5ff4643234d2d735cfAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a5bfb13b4f406aef1a450f99d22d3e48df01528cAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 99202d94909d323a30d154ab0261c0a07166daecAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 14c673a2f3ecf650b694a52a88688f1d71849899Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4840ceadef4290c56cc422f0fc697655f3cbf070Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.4.301 through 5.4.*Not affected
5.10.246 through 5.10.*Not affected
5.15.196 through 5.15.*Not affected
6.1.158 through 6.1.*Not affected
6.6.115 through 6.6.*Not affected
6.12.56 through 6.12.*Not affected
6.17.6 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.