CVE-2025-68767

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-68767
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68767.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-68767
Downstream
Related
Published
2026-01-13T15:28:46.382Z
Modified
2026-03-20T12:46:28.687556Z
Summary
hfsplus: Verify inode mode when loading from disk
Details

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: Verify inode mode when loading from disk

syzbot is reporting that SIFMT bits of inode->imode can become bogus when the S_IFMT bits of the 16bits "mode" field loaded from disk are corrupted.

According to [1], the permissions field was treated as reserved in Mac OS 8 and 9. According to [2], the reserved field was explicitly initialized with 0, and that field must remain 0 as long as reserved. Therefore, when the "mode" field is not 0 (i.e. no longer reserved), the file must be SIFDIR if dir == 1, and the file must be one of SIFREG/SIFLNK/SIFCHR/ SIFBLK/SIFIFO/S_IFSOCK if dir == 0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68767.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Fixed
6f768724aabd5b321c5b8f15acdca11e4781cf32
Fixed
d92333c7a35856e419500e7eed72dac1afa404a5
Fixed
001f44982587ad462b3002ee40c75e8df67d597d
Fixed
05ec9af3cc430683c97f76027e1c55ac6fd25c59
Fixed
edfb2e602b5ba5ca6bf31cbac20b366efb72b156
Fixed
91f114bffa36ce56d0e1f60a0a44fc09baaefc79
Fixed
005d4b0d33f6b4a23d382b7930f7a96b95b01f39

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68767.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.12
Fixed
5.10.248
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.198
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.160
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.120
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.64
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68767.json"