CVE-2025-71271

A flaw was found in the hfsplus filesystem driver in the Linux kernel. A bug was introduced during the conversion of hfsplus to the new mount API, leading to a memory leak. If the setup_bdev_super() function fails after a new superblock is allocated but before hfsplus_fill_super() takes ownership of the filesystem-specific data, the sb->s_fs_info memory is not properly cleaned up. This can result in system resource exhaustion.

This vulnerability is rated as Moderate severity for Red Hat because exploitation requires local privileges to attempt mounting an HFS+ filesystem, constraining the impact to local denial of service via memory exhaustion rather than remote compromise or privilege escalation. In typical enterprise server deployments, mounting HFS+ volumes is an uncommon operational requirement, significantly limiting practical exposure. Additionally, the kernel mount API refactoring associated with this flaw is absent in supported Red Hat Enterprise Linux releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.