CVE-2025-40349: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40349 is a slab-out-of-bounds read vulnerability in the Linux kernel's HFS+ filesystem driver, specifically in the hfsplus_bmap_alloc function. The flaw occurs when a record offset or length in a crafted HFS+ filesystem image is larger than the node size, triggering a KASAN-detected out-of-bounds memory access. It was published on December 16, 2025, and affects multiple stable Linux kernel versions. The CVSS score has not been formally assigned at the time of this report, and the CVE status is listed as Unknown (Feedly, CVE.org).

The root cause is insufficient validation of record offsets and lengths within the hfsplus_bmap_alloc function in the Linux kernel's HFS+ filesystem implementation (CWE-125: Out-of-bounds Read). When a maliciously crafted HFS+ filesystem image contains a record offset or length value exceeding the node size, the kernel reads beyond the allocated slab buffer, as evidenced by the KASAN crash trace showing a read of 8 bytes at an out-of-bounds address. The call chain leading to the crash involves hfsplus_bmap_alloc → hfs_btree_inc_height → hfsplus_brec_insert → __hfsplus_ext_write_extent → hfsplus_file_extend → hfsplus_get_block, triggered during a write operation on the crafted filesystem. The fix adds validation of record offsets and lengths against the node size before use (Feedly).

Successful exploitation of this vulnerability can cause a kernel crash (denial of service) on systems that mount a crafted HFS+ filesystem image. The out-of-bounds read may also expose sensitive kernel memory contents, posing a confidentiality risk. Since exploitation requires mounting a malicious filesystem, the primary risk is to systems that automatically mount removable media or process untrusted disk images, such as desktop systems or forensic workstations (Feedly).

1. Craft a malicious HFS+ image: Create a specially crafted HFS+ filesystem image where one or more B-tree node record offsets or lengths are set to values exceeding the node size.
2. Deliver the image: Place the crafted image on removable media (e.g., USB drive) or make it available for mounting via a network share or download.
3. Trigger mounting: Cause the target Linux system to mount the crafted HFS+ image — either by physical insertion of media on a system with automount enabled, or by convincing a user/administrator to manually mount the image.
4. Trigger the vulnerable code path: Perform a write operation on the mounted filesystem (e.g., creating or extending a file), which triggers the call chain through hfsplus_write_begin → hfsplus_get_block → hfsplus_file_extend → hfsplus_bmap_alloc.
5. Achieve crash or memory disclosure: The kernel reads out-of-bounds slab memory, resulting in a kernel panic (denial of service) or potential exposure of kernel memory contents (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) containing BUG: KASAN: slab-out-of-bounds in hfsplus_bmap_alloc with a stack trace referencing hfs_btree_inc_height, hfsplus_brec_insert, hfsplus_file_extend, or hfsplus_get_block.
• System Events: Unexpected kernel panics or system reboots coinciding with the mounting of HFS+ filesystem images or insertion of removable media.
• File System: Presence of unusual or externally sourced HFS+ disk image files (.dmg, .img, .hfs) on the system, particularly in temporary or download directories.

The Linux kernel maintainers have released patches for multiple stable branches addressing this vulnerability, with fixes committed to the stable kernel trees (referenced by commits 4f40a2b, 17ed51c, 40dfe7a, 0058d20, and 068a46d). Users should update to a patched kernel version as provided by their Linux distribution — Amazon Linux 2 users can refer to advisories ALAS2KERNEL-5.4-2025-114 and ALAS2KERNEL-5.10-2026-112 (Amazon Linux Advisory, Amazon Linux Advisory 5.10). As a workaround, administrators can disable automatic mounting of HFS/HFS+ filesystems (e.g., by blacklisting the hfsplus kernel module via /etc/modprobe.d/) on systems that do not require HFS+ support.