CVE-2025-40351: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40351 is a kernel memory safety vulnerability in the Linux kernel's HFS+ (hfsplus) filesystem driver, specifically an uninitialized value (KMSAN uninit-value) bug in the hfsplus_delete_cat() function. The issue was reported by syzbot and affects the Linux kernel across multiple stable branches. It was published on December 16, 2025, with fixes backported to multiple stable kernel versions (Feedly). The CVSS score has not been formally assigned at the time of this report, and the CVE status is listed as "Unknown" (Feedly).

The root cause is use of an uninitialized memory value (CWE-457) within the HFS+ filesystem driver. Specifically, hfsplus_subfolders_inc() stores an uninitialized value to memory during directory creation (hfsplus_create_cat() → hfsplus_mknod() → hfsplus_mkdir()), which is later read by hfsplus_subfolders_dec() during directory deletion (hfsplus_delete_cat() → hfsplus_rmdir()). The bug was detected by KMSAN (Kernel Memory Sanitizer) via syzbot fuzzing, indicating it requires local filesystem operations (mounting an HFS+ volume and performing mkdir/rmdir operations) to trigger (Feedly). Fixes were committed to multiple stable kernel trees via patches at git.kernel.org (commits 1b9e5ade, 2bb8bc99, 9b3d15a7, 9df3c241, 4891bf2b).

Exploitation of this vulnerability could lead to kernel instability or a system crash (denial of service) due to the use of uninitialized memory in a critical filesystem code path. In certain scenarios, reading uninitialized kernel memory may also expose sensitive kernel data, posing a limited information disclosure risk. The impact is generally local and confined to systems that mount HFS+ filesystems, which is more common in environments interoperating with macOS-formatted volumes (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2025-40351. The EPSS score is very low at 0.024%, reflecting minimal exploitation probability (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to a system that mounts an HFS+ filesystem, significantly limiting the attack surface.

Apply the upstream Linux kernel patches that fix the uninitialized value in hfsplus_delete_cat(). Fixes have been committed to multiple stable kernel branches (commits 1b9e5ade272f, 2bb8bc99b1a7, 9b3d15a75891, 9df3c241fbf6, 4891bf2b09c3 on git.kernel.org). Distributions including Amazon Linux 2 (kernel 5.4 and 5.10) have issued updated packages (Amazon Linux ALAS). As a workaround, avoid mounting untrusted or unnecessary HFS+ filesystems on affected systems until a patched kernel is applied.