CVE-2025-68767: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68767 is a vulnerability in the Linux kernel's HFS+ filesystem driver (hfsplus) where the kernel fails to validate inode mode bits when loading inodes from disk. When the 16-bit mode field on disk is corrupted, the S_IFMT (file type) bits in inode->i_mode can become bogus, leading to denial-of-service conditions. The vulnerability was reported by syzbot and published on January 13, 2026. It affects Linux kernel versions from the initial commit through multiple stable branches, with fixes available in versions 6.1.160, 6.6.120, 6.12.64, 6.18.3, and 6.19-rc1. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is insufficient input validation (improper data validation) in the HFS+ filesystem inode loading path. When the kernel reads a filesystem inode from disk, it does not verify that the mode field's S_IFMT bits are consistent with the directory flag (dir): if dir == 1, the file type must be S_IFDIR; if dir == 0, the type must be one of S_IFREG, S_IFLNK, S_IFCHR, S_IFBLK, S_IFIFO, or S_IFSOCK. The HFS+ permissions field was historically reserved (initialized to 0) in Mac OS 8/9, so a non-zero corrupted value propagates invalid file type bits into the kernel's in-memory inode structure. An attacker with local access can trigger this by mounting a specially crafted or corrupted HFS+ filesystem image, causing kernel crashes or hangs when the corrupted inodes are subsequently accessed (Feedly).

Successful exploitation results in a denial-of-service condition — specifically kernel crashes or hangs — when corrupted HFS+ inodes are accessed by the filesystem layer. The impact is limited to availability (CVSS availability impact: High), with no confidentiality or integrity impact. The vulnerability is locally scoped and does not enable lateral movement or data exfiltration, but could be used to destabilize or crash a system that mounts untrusted HFS+ filesystem images (Feedly, Microsoft MSRC).

Apply the available kernel patches for your Linux distribution. Fixed versions include Linux kernel 6.1.160, 6.6.120, 6.12.64, 6.18.3, and 6.19-rc1. Microsoft has released patches for Azure Linux 3 (kernel 6.6.119.3-3). Debian, Ubuntu (USN-8177-1, USN-8179-1, USN-8183-1, USN-8184-1, USN-8185-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1), and Amazon Linux 2 have also issued advisories. As interim mitigations: restrict filesystem mounting privileges to trusted users only, avoid mounting HFS+ images from untrusted or external sources, and consider disabling HFS+ filesystem support (modprobe -r hfsplus) if it is not required in your environment (Feedly, Ubuntu USN-8177-1, Debian LTS).

The vulnerability was identified via syzbot, Google's automated kernel fuzzing system, and addressed through the standard Linux kernel stable patch process. Red Hat, Ubuntu, Debian, and Amazon Linux have all issued security advisories. No notable independent researcher commentary or significant social media discussion has been observed beyond routine distribution security update announcements.