Critical Slab-Out-Of-Bounds Vulnerability in Linux Kernel Affecting Debian Packages
Summary
CVE-2025-38713: In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc(): [ 667.121659][... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other parts of the system, including process management, memory management, and device control. This vulnerability specifically affects the hfsplus file system driver, which is used for reading and writing HFS+ file systems, commonly found in macOS. The vulnerability can lead to crashes and potential data corruption, making it critical for users relying on this functionality.
Vulnerability Detail
The vulnerability, identified as CVE-2025-38713, originates from a slab-out-of-bounds read in the hfsplus_uni2asc() function. This issue can be triggered by the hfsplus_readdir() method, which may lead to a crash when it attempts to read beyond the allocated memory. The technical implications include potential system instability and data loss, as the kernel may access invalid memory addresses, resulting in undefined behavior.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the hfsplus file system until the kernel has been updated to a patched version. This may involve remounting affected file systems with a different file system type or using alternative storage solutions.
Conclusion
CVE-2025-38713 is a critical vulnerability affecting the Linux kernel's hfsplus file system driver, which can lead to serious system issues. Users are strongly advised to update their systems to the latest patched versions to mitigate risks. For those unable to update immediately, avoiding the use of the affected file system is recommended.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38713 is a vulnerability in the Linux kernel that allows for slab-out-of-bounds reads in the hfsplus file system driver, potentially leading to system crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include system instability, potential data loss, and crashes when accessing HFS+ file systems.
Yes, patches are available for Debian 13 and 14. Users should update to versions 6.12.43-1 and 6.16.3-1, respectively.
If an immediate update is not possible, avoid using the hfsplus file system as a temporary workaround until the system can be patched.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
