CVE-2025-71230: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-71230 is a memory leak vulnerability in the Linux kernel's HFS (Hierarchical File System) filesystem driver that can lead to denial of service. The flaw was introduced when the HFS driver was converted to the new mount API, creating a bug in the allocation pattern of sb->s_fs_info. It affects Linux kernel versions 6.13 through 6.18.10 and 6.19 through 6.19.0, and was published on February 18, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Microsoft MSRC, Feedly).

The root cause is a memory leak (CWE-401) in the HFS filesystem driver's mount path. When sget_fc() allocates a new superblock and setup_bdev_super() subsequently fails, the filesystem-specific s_fs_info data is allocated but never freed because hfs_fill_super() — which would normally take ownership — is never reached. The fix ensures hfs_kill_super() always frees sb->s_fs_info, closing the leak regardless of mount failure. Patches are available in the Linux kernel stable tree (kernel.org patch 1, kernel.org patch 2, kernel.org patch 3).

A local attacker with low privileges can repeatedly trigger the memory leak by attempting to mount a crafted HFS filesystem that causes setup_bdev_super() to fail. Repeated exploitation exhausts available kernel memory, resulting in performance degradation and potential denial of service conditions affecting overall system stability. There is no impact on confidentiality or integrity — only availability is affected (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018%, reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and the ability to perform mount operations (Feedly).

Update the Linux kernel to version 6.18.11 or later (for the 6.13–6.18.x branch) or to version 6.19.1 or later (for the 6.19.x branch). Microsoft has also released a patch for the Azure Linux 3 kernel (azl3_kernel_6.6.121.1-1) as of February 21, 2026. If immediate patching is not possible, restrict local user access to mount operations (e.g., via CAP_SYS_ADMIN controls or namespace restrictions) to reduce the attack surface, and monitor kernel memory usage for unusual patterns (Microsoft MSRC, Feedly).