CVE-2025-38714: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38714 is a slab-out-of-bounds read vulnerability in the Linux kernel's HFS+ filesystem implementation, specifically within the hfsplus_bnode_read() function. It was disclosed on September 4, 2025, and affects Linux kernel versions from 2.6.13 through multiple stable branches up to (but not including) fixed versions: 5.4.297, 5.10.241, 5.15.190, 6.1.149, 6.6.103, 6.12.43, 6.15.11, and 6.16.2. Debian Linux 11.0 is also listed as an affected product. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and is triggered when hfsplus_bnode_read() attempts to read 8 bytes at an invalid memory address outside the allocated slab buffer boundaries. The flaw can be reached through normal HFS+ filesystem operations such as file deletion — specifically via the call chain hfsplus_unlink() → hfsplus_delete_cat() → hfsplus_delete_all_attrs() → __hfsplus_delete_attr() → hfsplus_brec_remove() → hfsplus_bnode_dump() → hfsplus_bnode_read(). Exploitation requires a low-privileged local user account and no user interaction, with the KASAN subsystem reporting the read at address ffff88810b5fc6c0 during reproduction on kernel 6.16.0-rc3 (Red Hat Bugzilla).

Successful exploitation can result in two primary impacts: unauthorized disclosure of sensitive kernel memory contents (high confidentiality impact) and denial of service through system crashes or hangs (high availability impact). The vulnerability does not allow code execution or data modification, so integrity is unaffected. The attack is confined to the local system and does not enable lateral movement, but kernel memory disclosure could expose sensitive data such as cryptographic material or credentials held in kernel space (Red Hat Advisory).

Apply the relevant kernel security updates for your stable branch: Linux kernel versions 5.4.297, 5.10.241, 5.15.190, 6.1.149, 6.6.103, 6.12.43, 6.15.11, or 6.16.2 and later contain the fix. Patches are available via the upstream stable kernel tree and have been incorporated into distribution updates for Debian and Amazon Linux 2. As a workaround, if HFS+ filesystem support is not required, disabling or blacklisting the hfsplus kernel module (modprobe -r hfsplus or adding blacklist hfsplus to /etc/modprobe.d/) will eliminate the attack surface. Restricting local user access to systems reduces exposure until patching is complete (Red Hat Advisory, Red Hat Bugzilla).