CVE-2025-40088

A slab-out-of-bounds read flaw was found in the Linux kernel's HFS+ filesystem driver. In hfsplus_strcasecmp(), improper bounds checking during string comparison operations allows reading beyond the allocated slab memory. This can be triggered during filesystem operations such as path lookup or unmount on a crafted or corrupted HFS+ filesystem. A local user with the ability to mount HFS+ filesystems could exploit this to cause a denial of service or potentially leak kernel memory contents.

This vulnerability requires local access and the ability to mount HFS+ filesystems. The out-of-bounds read could lead to information disclosure or system instability. Systems that do not use HFS+ filesystem support are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the hfsplus module from being loaded if HFS+ filesystem support is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.