CVE-2025-40082: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-40082 Overview

CVE-2025-40082 is an out-of-bounds read vulnerability [CWE-125] in the Linux kernel's HFS+ filesystem implementation. The flaw resides in the hfsplus_uni2asc() function within fs/hfsplus/unicode.c and is reachable through the listxattr system call path. When hfsplus_uni2asc() is invoked from hfsplus_listxattr(), it receives a struct hfsplus_attr_unistr* whose layout differs from struct hfsplus_unistr*, allowing the unicode buffer pointer to advance past allocated memory. A previous fix (commit 94458781aee6) did not cover this second structure.

Critical Impact
A local, authenticated user can trigger a kernel slab out-of-bounds read by listing extended attributes on a crafted HFS+ filesystem, leading to information disclosure or kernel panic.

Affected Products

Linux Kernel (multiple stable branches prior to the fix commits)
Kernel version 6.16.4 confirmed vulnerable per KASAN report
Systems mounting untrusted HFS+ volumes with extended attribute support

Discovery Timeline

2025-10-28 - CVE-2025-40082 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-40082

Vulnerability Analysis

The vulnerability is a slab out-of-bounds read detected by the Kernel Address Sanitizer (KASAN) during a call to hfsplus_uni2asc+0xa71/0xb90 at fs/hfsplus/unicode.c:186. The trigger path proceeds from path_listxattrat through vfs_listxattr into hfsplus_listxattr at fs/hfsplus/xattr.c:738, which then invokes the unicode-to-ASCII conversion routine on an extended-attribute name buffer. The read of size 2 bytes occurs beyond the end of a kmalloc-allocated region originally sized by hfsplus_find_init() at fs/hfsplus/bfind.c:21.

Because the flaw is reachable via the listxattr(2) syscall, exploitation requires local access and the ability to mount or read a maliciously crafted HFS+ image. The out-of-bounds read can expose adjacent slab contents to the calling task or destabilize the kernel.

Root Cause

hfsplus_uni2asc() was written to consume a struct hfsplus_unistr*, but hfsplus_listxattr() passes a struct hfsplus_attr_unistr*. The two structures have different sizes, so the ustrlen value derived from the attribute-format structure does not correspond to the underlying buffer size. The function advances its pointer across the unicode buffer using an unchecked length, walking past the allocated region.

Attack Vector

A local user with permission to mount a filesystem image, or to read extended attributes on an attacker-controlled HFS+ volume, can craft a hfsplus_attr_unistr entry with a ustrlen value larger than the surrounding allocation. Calling listxattr(2) on a file within that volume triggers the out-of-bounds read inside hfsplus_uni2asc().

The upstream fix introduces two wrapper functions, hfsplus_uni2asc_xattr_str and hfsplus_uni2asc_str, which handle the two structure types separately and clamp ustrlen to a safe upper bound derived from the allocation size. No public proof-of-concept exploit or ExploitDB entry is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-40082

Indicators of Compromise

KASAN reports in dmesg containing slab-out-of-bounds in hfsplus_uni2asc with a call trace through hfsplus_listxattr and path_listxattrat.
Unexpected kernel oops or panic messages referencing fs/hfsplus/unicode.c or fs/hfsplus/xattr.c.
Presence of unknown or attacker-supplied HFS+ disk images (.dmg, .img) mounted by non-administrative users.

Detection Strategies

Enable KASAN on test or staging kernels to catch out-of-bounds reads reaching hfsplus_uni2asc() during fuzzing or regression testing.
Audit kernel logs for repeated listxattr syscalls against HFS+ mount points followed by kernel warnings.
Inventory kernel versions across Linux fleets and flag hosts running builds that predate the fix commits 343fe375, 5b522896, 782acde4, 857aefc7, bea3e1d4, and c3db89ea.

Monitoring Recommendations

Monitor mount(2) and listxattr(2) syscall telemetry on hosts where HFS+ is loaded, correlating with the invoking user and image source.
Alert on loading of the hfsplus kernel module on production systems where it is not required.
Track process and container activity that interacts with removable media or user-supplied disk images.

How to Mitigate CVE-2025-40082

Immediate Actions Required

Apply the stable-tree fix commits referenced in the vendor advisories to all Linux kernels running affected branches.
Blacklist or unload the hfsplus kernel module on systems that do not require HFS+ support: echo "blacklist hfsplus" > /etc/modprobe.d/hfsplus.conf.
Restrict unprivileged users from mounting arbitrary filesystem images via mount(8), FUSE, or automount services.

Patch Information

The fix introduces hfsplus_uni2asc_xattr_str and hfsplus_uni2asc_str wrapper functions that select the correct structure type and cap ustrlen at the allocated buffer size. Patched builds are available in the upstream stable trees via the following commits: Kernel Commit 343fe37, Kernel Commit 5b52289, Kernel Commit 782acde, Kernel Commit 857aefc, Kernel Commit bea3e1d, and Kernel Commit c3db89e. Consume the fix through your distribution's kernel updates once available.

Workarounds

Disable or blacklist the hfsplus module on servers and workstations that never handle HFS+ media.
Prevent unprivileged mounting of untrusted disk images by tightening sudo policies and disabling user-session automount for external volumes.
Where HFS+ read access is required, mount images read-only from a dedicated, non-privileged namespace to reduce blast radius.

bash

# Configuration example: prevent hfsplus from auto-loading
echo "install hfsplus /bin/true" | sudo tee /etc/modprobe.d/disable-hfsplus.conf
sudo rmmod hfsplus 2>/dev/null || true
sudo update-initramfs -u