CVE-2025-40351

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc6-dirty #17

Description The Linux kernel contains a flaw in the HFS+ file system implementation. Specifically, a kernel memory safety issue (KMSAN) exists due to an uninitialized value in the hfsplus delete cat() function. This issue can lead to a kernel panic, as reported by the syzbot testing framework. The issue is related to memory allocation and handling within the HFS+ file system, potentially triggered during directory removal operations. The call trace indicates involvement of functions such as hfsplus subfolders dec, hfsplus rmdir, vfs rmdir, and do rmdir. The root cause appears to be related to uninitialized memory being used in the hfsplus subfolders inc function, which is called during the creation of catalog entries.

Recommendations Update to a newer version of the Linux kernel that addresses this issue.