Critical General Protection Fault in Linux Kernel - CVE-2025-38716
Summary
CVE-2025-38716: In the Linux kernel, the following vulnerability has been resolved: hfs: fix general protection fault in hfs_find_init() The hfs_find_init() method can trigger the crash if tree pointer is NULL: [ 45.746290][ T9787] Oops... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, managing system resources and facilitating communication between hardware and software. It is widely used across various platforms, including servers, desktops, and embedded systems. This vulnerability affects multiple Debian versions (11, 12, 13, and 14) of the Linux package, which is crucial for system stability and performance.
Vulnerability Detail
CVE-2025-38716 is a critical vulnerability in the Linux kernel that arises from a null pointer dereference in the hfs_find_init() method. This flaw can lead to a general protection fault, causing the system to crash. The vulnerability is triggered when the tree pointer is NULL, which can occur during file system operations involving HFS (Hierarchical File System). The ramifications include potential system downtime and data loss, making it imperative for users to address this issue promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid operations involving HFS file systems until the package is updated. This may help mitigate the risk of encountering the vulnerability until a permanent fix is applied.
Conclusion
CVE-2025-38716 is a critical vulnerability in the Linux kernel that poses a significant risk to system stability. Users are advised to update their packages to the patched versions to mitigate the risk of system crashes and data loss. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38716 is a vulnerability in the Linux kernel that can cause a system crash due to a null pointer dereference in the hfs_find_init() method.
Debian versions 11, 12, 13, and 14 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to system crashes and potential data loss, affecting system stability and performance.
You can apply the patch by updating the Linux package to the fixed versions: 6.12.43-1 for Debian 13 and 6.16.3-1 for Debian 14 using the command: sudo apt-get update && sudo apt-get install linux.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
