CVE-2025-38714: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-38714 Overview

CVE-2025-38714 is a slab out-of-bounds read vulnerability in the Linux kernel's HFS+ filesystem implementation. The flaw resides in the hfsplus_bnode_read() function, which fails to validate read boundaries when processing B-tree nodes. A local attacker with low privileges can trigger the condition by operating on a crafted HFS+ filesystem, leading to kernel memory disclosure or system crashes. The issue was detected by KASAN during hfsplus_unlink() operations that traverse extended attribute B-trees. The vulnerability is classified as [CWE-125] Out-of-Bounds Read and affects multiple stable Linux kernel branches, with Debian and Siemens issuing coordinated advisories.

Critical Impact
Local attackers can trigger kernel memory corruption through crafted HFS+ filesystems, resulting in information disclosure or denial of service on affected hosts.

Affected Products

Linux Kernel (multiple stable branches, including versions derived from 2.6.12 baseline)
Debian Linux 11.0
Siemens industrial products bundling affected kernel versions (per SSA-032379)

Discovery Timeline

2025-09-04 - CVE-2025-38714 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38714

Vulnerability Analysis

The vulnerability exists in the HFS+ filesystem driver, specifically within the hfsplus_bnode_read() helper responsible for reading data from B-tree nodes into caller-supplied buffers. KASAN instrumentation captured an 8-byte read at address ffff88810b5fc6c0 extending past the allocated slab region. The out-of-bounds read is reachable through the standard unlink() syscall path when the target inode has extended attributes stored in the HFS+ attribute B-tree.

The call chain begins in __x64_sys_unlink and descends through vfs_unlink, hfsplus_unlink, hfsplus_delete_cat, hfsplus_delete_all_attrs, __hfsplus_delete_attr, and hfsplus_brec_remove. During record removal, hfsplus_bnode_dump() invokes hfsplus_bnode_read() with offsets or lengths that exceed the actual node buffer allocated by __hfs_bnode_create().

Root Cause

The root cause is missing bounds validation between the requested read length or offset and the node's allocated size within the HFS+ B-tree cache. When a crafted or corrupted HFS+ volume presents inconsistent B-tree metadata, downstream helpers trust the on-disk values and issue reads beyond the slab allocation returned by __kmalloc_noprof. This trust boundary violation aligns with [CWE-125], where filesystem parsing code dereferences attacker-influenced size fields without sanity checks.

Attack Vector

Exploitation requires local access and the ability to mount or operate on an attacker-controlled HFS+ image. On systems where non-root users can mount removable media through automount services or where privileged services process user-supplied disk images, an attacker crafts a malformed HFS+ attribute B-tree, mounts the volume, and issues an unlink() against a file with extended attributes. The resulting out-of-bounds read can leak adjacent slab memory into kernel log paths or induce a KASAN panic, producing denial of service. The vulnerability is not remotely exploitable and requires no user interaction beyond the initial mount.

See the Linux kernel commit history for the full patch series and technical details of the affected code paths.

Detection Methods for CVE-2025-38714

Indicators of Compromise

Kernel log entries containing BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read on KASAN-enabled builds.
Unexpected kernel oops or panic messages referencing hfsplus_bnode_dump, hfsplus_brec_remove, or hfsplus_delete_all_attrs.
Mount events for HFS+ volumes originating from removable media or user-writable directories on multi-user systems.

Detection Strategies

Audit mount syscalls with filesystem type hfsplus using auditd rules and correlate with the invoking user context.
Monitor dmesg and /var/log/kern.log for filesystem parsing errors, KASAN reports, and repeated unlink failures on HFS+ mounts.
Inventory hosts still exposing the hfsplus kernel module and flag any that permit unprivileged mounts through udisks2 or pmount.

Monitoring Recommendations

Forward kernel ring buffer and audit logs to a central SIEM and alert on HFS+ mount activity from non-administrative accounts.
Track kernel package versions across the fleet and compare against the fixed commits published on git.kernel.org to identify unpatched hosts.
Watch for process crashes in userland utilities that iterate HFS+ metadata, which may indicate active probing.

How to Mitigate CVE-2025-38714

Immediate Actions Required

Apply the vendor-supplied kernel update for your distribution as soon as it is available.
Disable automatic mounting of removable HFS+ media on multi-user and server systems until patches are deployed.
Restrict which users may invoke mount for filesystem type hfsplus through polkit rules or sudoers policy.

Patch Information

The Linux kernel maintainers merged fixes across multiple stable branches. Relevant commits include 475d770c19929082aab43337e6c077d0e2043df3, 291b7f2538920aa229500dbdd6c5f0927a51bc8b, 032f7ed6717a4cd3714f9801be39fdfc7f1c7644, 5ab59229bef6063edf3a6fc2e3e3fd7cd2181b29, 7fa4cef8ea13b37811287ef60674c5fd1dd02ee6, 8583d067ae22b7f32ce5277ca5543ac8bf86a3e5, a2abd574d2fe22b8464cf6df5abb6f24d809eac0, c80aa2aaaa5e69d5219c6af8ef7e754114bd08d2, and ffee8a7bed0fbfe29da239a922b59c5db897c613. Debian LTS shipped fixes in the DLA-2025 October advisory series and a follow-up advisory. Siemens tracks the issue in SSA-032379.

Workarounds

Blacklist the hfsplus kernel module on systems that do not require HFS+ support.
Configure udisks2 and desktop automount agents to reject HFS+ volumes from untrusted media.
Enforce read-only mounts for any legitimate HFS+ volumes to reduce the likelihood of reaching the vulnerable hfsplus_brec_remove path.

bash

# Blacklist the hfsplus module to prevent loading
echo "blacklist hfsplus" | sudo tee /etc/modprobe.d/blacklist-hfsplus.conf
sudo rmmod hfsplus 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep hfsplus