In the Linux kernel, the following vulnerability has been resolved:
hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp()
The hfsplus_strcasecmp() logic can trigger the issue:
[ 117.317703][ T9855] ================================================================== [ 117.318353][ T9855] BUG: KASAN: slab-out-of-bounds in hfsplusstrcasecmp+0x1bc/0x490 [ 117.318991][ T9855] Read of size 2 at addr ffff88802160f40c by task repro/9855 [ 117.319577][ T9855] [ 117.319773][ T9855] CPU: 0 UID: 0 PID: 9855 Comm: repro Not tainted 6.17.0-rc6 #33 PREEMPT(full) [ 117.319780][ T9855] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 117.319783][ T9855] Call Trace: [ 117.319785][ T9855] <TASK> [ 117.319788][ T9855] dumpstacklvl+0x1c1/0x2a0 [ 117.319795][ T9855] ? virtaddrvalid+0x1c8/0x5c0 [ 117.319803][ T9855] ? _pfxdumpstacklvl+0x10/0x10 [ 117.319808][ T9855] ? rcuiswatching+0x15/0xb0 [ 117.319816][ T9855] ? lockrelease+0x4b/0x3e0 [ 117.319821][ T9855] ? _kasancheckbyte+0x12/0x40 [ 117.319828][ T9855] ? _virtaddrvalid+0x1c8/0x5c0 [ 117.319835][ T9855] ? _virtaddrvalid+0x4a5/0x5c0 [ 117.319842][ T9855] printreport+0x17e/0x7e0 [ 117.319848][ T9855] ? _virtaddrvalid+0x1c8/0x5c0 [ 117.319855][ T9855] ? _virtaddrvalid+0x4a5/0x5c0 [ 117.319862][ T9855] ? _physaddr+0xd3/0x180 [ 117.319869][ T9855] ? hfsplusstrcasecmp+0x1bc/0x490 [ 117.319876][ T9855] kasanreport+0x147/0x180 [ 117.319882][ T9855] ? hfsplusstrcasecmp+0x1bc/0x490 [ 117.319891][ T9855] hfsplusstrcasecmp+0x1bc/0x490 [ 117.319900][ T9855] ? _pfxhfspluscatcasecmpkey+0x10/0x10 [ 117.319906][ T9855] hfsfindrecbykey+0xa9/0x1e0 [ 117.319913][ T9855] _hfsplusbrecfind+0x18e/0x470 [ 117.319920][ T9855] ? _pfxhfsplusbnodefind+0x10/0x10 [ 117.319926][ T9855] ? _pfxhfsfindrecbykey+0x10/0x10 [ 117.319933][ T9855] ? _pfxhfsplusbrecfind+0x10/0x10 [ 117.319942][ T9855] hfsplusbrecfind+0x28f/0x510 [ 117.319949][ T9855] ? pfxhfsfindrecbykey+0x10/0x10 [ 117.319956][ T9855] ? _pfxhfsplusbrecfind+0x10/0x10 [ 117.319963][ T9855] ? _kmallocnoprof+0x2a9/0x510 [ 117.319969][ T9855] ? hfsplusfindinit+0x8c/0x1d0 [ 117.319976][ T9855] hfsplusbrecread+0x2b/0x120 [ 117.319983][ T9855] hfspluslookup+0x2aa/0x890 [ 117.319990][ T9855] ? _pfxhfspluslookup+0x10/0x10 [ 117.320003][ T9855] ? dallocparallel+0x2f0/0x15e0 [ 117.320008][ T9855] ? _lockacquire+0xaec/0xd80 [ 117.320013][ T9855] ? _pfxdallocparallel+0x10/0x10 [ 117.320019][ T9855] ? _rawspinlockinit+0x45/0x100 [ 117.320026][ T9855] ? _initwaitqueuehead+0xa9/0x150 [ 117.320034][ T9855] _lookupslow+0x297/0x3d0 [ 117.320039][ T9855] ? _pfxlookupslow+0x10/0x10 [ 117.320045][ T9855] ? downread+0x1ad/0x2e0 [ 117.320055][ T9855] lookupslow+0x53/0x70 [ 117.320065][ T9855] walkcomponent+0x2f0/0x430 [ 117.320073][ T9855] pathlookupat+0x169/0x440 [ 117.320081][ T9855] filenamelookup+0x212/0x590 [ 117.320089][ T9855] ? pfxfilenamelookup+0x10/0x10 [ 117.320098][ T9855] ? strncpyfromuser+0x150/0x290 [ 117.320105][ T9855] ? getnameflags+0x1e5/0x540 [ 117.320112][ T9855] userpathat+0x3a/0x60 [ 117.320117][ T9855] _x64sysumount+0xee/0x160 [ 117.320123][ T9855] ? _pfxx64sysumount+0x10/0x10 [ 117.320129][ T9855] ? dosyscall64+0xb7/0x3a0 [ 117.320135][ T9855] ? entrySYSCALL64afterhwframe+0x77/0x7f [ 117.320141][ T9855] ? entrySYSCALL64afterhwframe+0x77/0x7f [ 117.320145][ T9855] dosyscall64+0xf3/0x3a0 [ 117.320150][ T9855] ? excpagefault+0x9f/0xf0 [ 117.320154][ T9855] entrySYSCALL64after_hwframe+0x77/0x7f [ 117.320158][ T9855] RIP: 0033:0x7f7dd7908b07 [ 117.320163][ T9855] Code: 23 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 08 [ 117.320167][ T9855] RSP: 002b:00007ffd5ebd9698 EFLAGS: 00000202 ---truncated---
[
{
"id": "CVE-2025-40088-053674e7",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "89164924523544756018925719516843502131",
"length": 532.0
},
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_strcasecmp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bc081ba6c52b0c88c92701e3fbc33c7e2277afb"
},
{
"id": "CVE-2025-40088-1085baf6",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "222449638417334296369240350986265549507",
"length": 482.0
},
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_strcmp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42520df65bf67189541a425f7d36b0b3e7bd7844"
},
{
"id": "CVE-2025-40088-226aafe1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "222449638417334296369240350986265549507",
"length": 482.0
},
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_strcmp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f5ab4a9c6abd8b0d713cc2b7b041bc10d70f241"
},
{
"id": "CVE-2025-40088-5c07558a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "89164924523544756018925719516843502131",
"length": 532.0
},
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_strcasecmp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f5ab4a9c6abd8b0d713cc2b7b041bc10d70f241"
},
{
"id": "CVE-2025-40088-717a980c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "89164924523544756018925719516843502131",
"length": 532.0
},
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_strcasecmp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef250c3edd995d7bb5a5e5122ffad1c28a8686eb"
},
{
"id": "CVE-2025-40088-8952bf97",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "222449638417334296369240350986265549507",
"length": 482.0
},
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_strcmp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@603158d4efa98a13a746bd586c20f194f4a31ec8"
},
{
"id": "CVE-2025-40088-8f67d2b8",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"251776680596463082343797933232948132717",
"143767282228063420716117472056458303148",
"123064156674774355462802147021877890094",
"92516399857782461611871822677919590326",
"10863980220854304069428739635286493226",
"1902354870236070192596062347055976123"
],
"threshold": 0.9
},
"target": {
"file": "fs/hfsplus/unicode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@586c75dfd1d265c4150f6529debb85c9d62e101f"
},
{
"id": "CVE-2025-40088-914cd558",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "222449638417334296369240350986265549507",
"length": 482.0
},
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_strcmp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef250c3edd995d7bb5a5e5122ffad1c28a8686eb"
},
{
"id": "CVE-2025-40088-a149c99a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"251776680596463082343797933232948132717",
"143767282228063420716117472056458303148",
"123064156674774355462802147021877890094",
"92516399857782461611871822677919590326",
"10863980220854304069428739635286493226",
"1902354870236070192596062347055976123"
],
"threshold": 0.9
},
"target": {
"file": "fs/hfsplus/unicode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42520df65bf67189541a425f7d36b0b3e7bd7844"
},
{
"id": "CVE-2025-40088-a26b51e5",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"251776680596463082343797933232948132717",
"143767282228063420716117472056458303148",
"123064156674774355462802147021877890094",
"92516399857782461611871822677919590326",
"10863980220854304069428739635286493226",
"1902354870236070192596062347055976123"
],
"threshold": 0.9
},
"target": {
"file": "fs/hfsplus/unicode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b47a75b6f762321f9eb6f31aab7bce47a37063b7"
},
{
"id": "CVE-2025-40088-ac6e599a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "89164924523544756018925719516843502131",
"length": 532.0
},
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_strcasecmp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@603158d4efa98a13a746bd586c20f194f4a31ec8"
},
{
"id": "CVE-2025-40088-b495376b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "89164924523544756018925719516843502131",
"length": 532.0
},
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_strcasecmp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b47a75b6f762321f9eb6f31aab7bce47a37063b7"
},
{
"id": "CVE-2025-40088-b51f0a50",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "89164924523544756018925719516843502131",
"length": 532.0
},
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_strcasecmp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@586c75dfd1d265c4150f6529debb85c9d62e101f"
},
{
"id": "CVE-2025-40088-b5a57fdf",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "222449638417334296369240350986265549507",
"length": 482.0
},
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_strcmp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@586c75dfd1d265c4150f6529debb85c9d62e101f"
},
{
"id": "CVE-2025-40088-c874a762",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "89164924523544756018925719516843502131",
"length": 532.0
},
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_strcasecmp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ab44236b32ed41eb0636797e8e8e885a2f3b18a"
},
{
"id": "CVE-2025-40088-d468dc4b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "89164924523544756018925719516843502131",
"length": 532.0
},
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_strcasecmp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42520df65bf67189541a425f7d36b0b3e7bd7844"
},
{
"id": "CVE-2025-40088-d848b33b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"251776680596463082343797933232948132717",
"143767282228063420716117472056458303148",
"123064156674774355462802147021877890094",
"92516399857782461611871822677919590326",
"10863980220854304069428739635286493226",
"1902354870236070192596062347055976123"
],
"threshold": 0.9
},
"target": {
"file": "fs/hfsplus/unicode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@603158d4efa98a13a746bd586c20f194f4a31ec8"
},
{
"id": "CVE-2025-40088-deb62546",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "222449638417334296369240350986265549507",
"length": 482.0
},
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_strcmp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bc081ba6c52b0c88c92701e3fbc33c7e2277afb"
},
{
"id": "CVE-2025-40088-e02e3be8",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"251776680596463082343797933232948132717",
"143767282228063420716117472056458303148",
"123064156674774355462802147021877890094",
"92516399857782461611871822677919590326",
"10863980220854304069428739635286493226",
"1902354870236070192596062347055976123"
],
"threshold": 0.9
},
"target": {
"file": "fs/hfsplus/unicode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef250c3edd995d7bb5a5e5122ffad1c28a8686eb"
},
{
"id": "CVE-2025-40088-e60acc53",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "222449638417334296369240350986265549507",
"length": 482.0
},
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_strcmp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ab44236b32ed41eb0636797e8e8e885a2f3b18a"
},
{
"id": "CVE-2025-40088-f22ad766",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"251776680596463082343797933232948132717",
"143767282228063420716117472056458303148",
"123064156674774355462802147021877890094",
"92516399857782461611871822677919590326",
"10863980220854304069428739635286493226",
"1902354870236070192596062347055976123"
],
"threshold": 0.9
},
"target": {
"file": "fs/hfsplus/unicode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f5ab4a9c6abd8b0d713cc2b7b041bc10d70f241"
},
{
"id": "CVE-2025-40088-f419e8ea",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"251776680596463082343797933232948132717",
"143767282228063420716117472056458303148",
"123064156674774355462802147021877890094",
"92516399857782461611871822677919590326",
"10863980220854304069428739635286493226",
"1902354870236070192596062347055976123"
],
"threshold": 0.9
},
"target": {
"file": "fs/hfsplus/unicode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bc081ba6c52b0c88c92701e3fbc33c7e2277afb"
},
{
"id": "CVE-2025-40088-f636e0aa",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"251776680596463082343797933232948132717",
"143767282228063420716117472056458303148",
"123064156674774355462802147021877890094",
"92516399857782461611871822677919590326",
"10863980220854304069428739635286493226",
"1902354870236070192596062347055976123"
],
"threshold": 0.9
},
"target": {
"file": "fs/hfsplus/unicode.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ab44236b32ed41eb0636797e8e8e885a2f3b18a"
},
{
"id": "CVE-2025-40088-feb0ba00",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "222449638417334296369240350986265549507",
"length": 482.0
},
"target": {
"file": "fs/hfsplus/unicode.c",
"function": "hfsplus_strcmp"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b47a75b6f762321f9eb6f31aab7bce47a37063b7"
}
]