In the Linux kernel, the following vulnerability has been resolved:
hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc()
The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc():
[ 667.121659][ T9805] ================================================================== [ 667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10 [ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full) [ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.124890][ T9805] Call Trace: [ 667.124893][ T9805] <TASK> [ 667.124896][ T9805] dump_stack_lvl+0x10e/0x1f0 [ 667.124911][ T9805] print_report+0xd0/0x660 [ 667.124920][ T9805] ? __virt_addr_valid+0x81/0x610 [ 667.124928][ T9805] ? __phys_addr+0xe8/0x180 [ 667.124934][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124942][ T9805] kasan_report+0xc6/0x100 [ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124959][ T9805] hfsplus_uni2asc+0x902/0xa10 [ 667.124966][ T9805] ? hfsplus_bnode_read+0x14b/0x360 [ 667.124974][ T9805] hfsplus_readdir+0x845/0xfc0 [ 667.124984][ T9805] ? __pfx_hfsplus_readdir+0x10/0x10 [ 667.124994][ T9805] ? stack_trace_save+0x8e/0xc0 [ 667.125008][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125015][ T9805] ? trace_lock_acquire+0x85/0xd0 [ 667.125022][ T9805] ? lock_acquire+0x30/0x80 [ 667.125029][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125037][ T9805] ? down_read_killable+0x1ed/0x4c0 [ 667.125044][ T9805] ? putname+0x154/0x1a0 [ 667.125051][ T9805] ? __pfx_down_read_killable+0x10/0x10 [ 667.125058][ T9805] ? apparmor_file_permission+0x239/0x3e0 [ 667.125069][ T9805] iterate_dir+0x296/0xb20 [ 667.125076][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.125084][ T9805] ? __pfx___x64_sys_getdents64+0x10/0x10 [ 667.125091][ T9805] ? __x64_sys_openat+0x141/0x200 [ 667.125126][ T9805] ? __pfx_filldir64+0x10/0x10 [ 667.125134][ T9805] ? do_user_addr_fault+0x7fe/0x12f0 [ 667.125143][ T9805] do_syscall_64+0xc9/0x480 [ 667.125151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9 [ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9 [ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9 [ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004 [ 667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110 [ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.125207][ T9805] </TASK> [ 667.125210][ T9805] [ 667.145632][ T9805] Allocated by task 9805: [ 667.145991][ T9805] kasan_save_stack+0x20/0x40 [ 667.146352][ T9805] kasan_save_track+0x14/0x30 [ 667.146717][ T9805] __kasan_kmalloc+0xaa/0xb0 [ 667.147065][ T9805] __kmalloc_noprof+0x205/0x550 [ 667.147448][ T9805] hfsplus_find_init+0x95/0x1f0 [ 667.147813][ T9805] hfsplus_readdir+0x220/0xfc0 [ 667.148174][ T9805] iterate_dir+0x296/0xb20 [ 667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.148937][ T9805] do_syscall_64+0xc9/0x480 [ 667.149291][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.149809][ T9805] [ 667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000 [ 667.150030][ T9805] which belongs to the cache kmalloc-2k of size 2048 [ 667.151282][ T9805] The buggy address is located 0 bytes to the right of [ 667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c) [ 667.1 ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-livepatch-4.14.355-280.695Upgrade kernel-tools-develUpgrade python-perfUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.10.242-239.961Upgrade bpftoolUpgrade kernel | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Sep 25, 2025 | Sep 25, 2025 |
| Oracle_linux | — | Upgrade kernel-uek | Oct 14, 2025 | Sep 4, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Sep 4, 2025 |
| Suse | — | Upgrade dtb-armUpgrade dtb-allwinnerUpgrade dtb-amdUpgrade reiserfs-kmp-rtUpgrade dtb-alteraUpgrade kernel-64kbUpgrade kernel-default-livepatch-develUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-docsUpgrade kernel-kvmsmall-develUpgrade dtb-marvellUpgrade gfs2-kmp-defaultUpgrade dtb-xilinxUpgrade kernel-64kb-optionalUpgrade kernel-debug-develUpgrade kernel-default-livepatchUpgrade kernel-zfcpdumpUpgrade kernel-azure-extraUpgrade kernel-64kb-extraUpgrade kernel-default-optionalUpgrade kernel-default-baseUpgrade kernel-preempt-develUpgrade dtb-lgUpgrade dtb-mediatekUpgrade dtb-freescaleUpgrade kernel-rt-develUpgrade kernel-devel-rtUpgrade reiserfs-kmp-defaultUpgrade dtb-apmUpgrade dtb-renesasUpgrade kernel-develUpgrade dtb-appleUpgrade dtb-socionextUpgrade cluster-md-kmp-rtUpgrade dtb-amazonUpgrade kernel-64kb-develUpgrade kernel-debugUpgrade gfs2-kmp-azureUpgrade kernel-default-develUpgrade kernel-source-azureUpgrade ocfs2-kmp-defaultUpgrade dtb-caviumUpgrade kernel-symsUpgrade dtb-hisiliconUpgrade ocfs2-kmp-azureUpgrade kernel-rt_debugUpgrade gfs2-kmp-64kbUpgrade kernel-preemptUpgrade dlm-kmp-azureUpgrade kernel-sourceUpgrade dtb-rockchipUpgrade cluster-md-kmp-defaultUpgrade dlm-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-obs-buildUpgrade dtb-exynosUpgrade kernel-azure-optionalUpgrade gfs2-kmp-rtUpgrade kernel-default-extraUpgrade kernel-debug-vdsoUpgrade kernel-azure-vdsoUpgrade dlm-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-rtUpgrade kernel-source-rtUpgrade kernel-default-base-rebuildUpgrade kernel-defaultUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-manUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-extraUpgrade kernel-macrosUpgrade kselftests-kmp-defaultUpgrade kernel-docs-htmlUpgrade kselftests-kmp-azureUpgrade kernel-azure-develUpgrade dtb-broadcomUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade dtb-sprdUpgrade dtb-qcomUpgrade dtb-amlogicUpgrade cluster-md-kmp-64kbUpgrade kernel-obs-qaUpgrade kselftests-kmp-64kbUpgrade kernel-syms-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-source-vanillaUpgrade kernel-azureUpgrade kernel-syms-azureUpgrade kernel-default-vdsoUpgrade dtb-nvidiaUpgrade kernel-rt-optional | Dec 5, 2025 | Oct 15, 2025 |
| Ubuntu | — | Upgrade linux-image-oracle-5.15Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-ibmUpgrade linux-image-nvidia-tegraUpgrade linux-image-aws-fips-5.15Upgrade linux-image-5.15.0-1102-azureUpgrade linux-image-5.15.0-1097-awsUpgrade linux-image-5.15.0-1094-oracleUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-5.15.0-1038-nvidia-tegra-igxUpgrade linux-image-5.15.0-1049-nvidia-tegraUpgrade linux-image-5.15.0-1091-ibmUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-generic-64kUpgrade linux-image-gke-64k-6.8Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-raspiUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-kvmUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-nvidia-5.15Upgrade linux-image-raspi-nolpaeUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-5.15.0-163-lowlatencyUpgrade linux-image-lowlatency-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-generic-64k-6.8Upgrade linux-image-aws-fipsUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-gkeop-5.15Upgrade linux-image-nvidia-6.8Upgrade linux-image-azureUpgrade linux-image-raspi-6.8Upgrade linux-image-realtime-5.15Upgrade linux-image-oracle-6.8Upgrade linux-image-virtual-6.8Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-oem-22.04aUpgrade linux-image-oem-22.04dUpgrade linux-image-realtime-6.8.1Upgrade linux-image-lowlatencyUpgrade linux-image-kvm-5.15Upgrade linux-image-5.15.0-1097-aws-64kUpgrade linux-image-5.15.0-163-generic-lpaeUpgrade linux-image-generic-5.15Upgrade linux-image-gke-6.8Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-gcp-fips-5.15Upgrade linux-image-gke-5.15Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-ibm-5.15Upgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-5.15.0-1038-nvidia-tegra-igx-rtUpgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1049-nvidia-tegra-rtUpgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-5.15.0-163-fipsUpgrade linux-image-5.15.0-1080-gkeopUpgrade linux-image-raspi-5.15Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-azure-5.15Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-fipsUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-aws-lts-24.04Upgrade linux-image-xilinx-6.8Upgrade linux-image-genericUpgrade linux-image-gke-64kUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-gcp-fipsUpgrade linux-image-oem-22.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-5.15.0-1101-azureUpgrade linux-image-azure-lts-24.04Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-aws-64k-5.15Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-generic-64k-5.15Upgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-azure-fipsUpgrade linux-image-5.15.0-163-generic-64kUpgrade linux-image-ibm-classicUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oem-20.04cUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-intelUpgrade linux-image-azure-fips-5.15Upgrade linux-image-gcp-5.15Upgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-aws-lts-22.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-nvidia-64kUpgrade linux-image-azure-fips-6.8Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-fips-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-5.15.0-1096-realtimeUpgrade linux-image-oracleUpgrade linux-image-oem-20.04Upgrade linux-image-gkeopUpgrade linux-image-intel-iotgUpgrade linux-image-aws-5.15Upgrade linux-image-5.15.0-1097-gcpUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-intel-iotg-5.15Upgrade linux-image-generic-lpae-5.15Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-oracle-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-gcpUpgrade linux-image-aws-64kUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-5.15.0-1092-nvidia-lowlatencyUpgrade linux-image-5.15.0-1089-kvmUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-1092-intel-iotgUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-5.15.0-1097-aws-fipsUpgrade linux-image-generic-6.8Upgrade linux-image-5.15.0-1093-gkeUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-5.15.0-163-lowlatency-64kUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-xilinxUpgrade linux-image-virtual-5.15Upgrade linux-image-virtualUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-realtimeUpgrade linux-image-lowlatency-5.15Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-ibm-6.8Upgrade linux-image-5.15.0-163-genericUpgrade linux-image-5.15.0-1089-intel-iot-realtimeUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-azure-cvmUpgrade linux-image-azure-6.8Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-awsUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-fips-5.15Upgrade linux-image-oem-22.04bUpgrade linux-image-5.15.0-1097-gcp-fipsUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-oem-20.04dUpgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-gkeUpgrade linux-image-gcp-6.8Upgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-5.15.0-1101-azure-fipsUpgrade linux-image-5.15.0-1092-nvidiaUpgrade linux-image-5.15.0-1091-raspiUpgrade linux-image-5.15.0-1061-xilinx-zynqmpUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-gcp-lts-22.04 | Dec 5, 2025 | Sep 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 19, 2025 | Sep 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub