CVE-2025-38712: hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()
In the Linux kernel, the following vulnerability has been resolved:
hfsplus: don't use BUGON() in hfspluscreateattributesfile()
When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplusfillsuper() assumes that the attributes file is not yet created, which later results in hitting BUGON() when hfspluscreateattributesfile() is called. Replace this BUGON() with -EIO error with a message to suggest running fsck tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() - Operational
Run the fsck tool when the filesystem reports the -EIO error.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38712?
CVE-2025-38712 has been rated as a medium severity vulnerability affecting the Linux Kernel.
How do I fix CVE-2025-38712?
To fix CVE-2025-38712, you should update to the latest stable version of the Linux kernel where the vulnerability has been addressed.
What are the main impacts of CVE-2025-38712?
The main impacts of CVE-2025-38712 include potential filesystem corruption due to erroneous volume header values.
Which versions of the Linux Kernel are affected by CVE-2025-38712?
CVE-2025-38712 affects various versions of the Linux Kernel up until the patch was applied in the stable releases.
Can CVE-2025-38712 be exploited remotely?
CVE-2025-38712 requires local access to the filesystem, so remote exploitation is not possible.