Critical Vulnerability in Linux Package: General Protection Fault in hfs_find_init() Method
Summary
DEBIAN-CVE-2025-38716: In the Linux kernel, the following vulnerability has been resolved: hfs: fix general protection fault in hfs_find_init() The hfs_find_init() method can trigger the crash if tree pointer is NULL: [ 45.746290][ T9787] Oops... Affects linux versions < 6.12.43-1. Fixed in 6.12.43-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system, responsible for managing system resources and facilitating communication between hardware and software. It supports a wide range of functionalities, including process management, memory management, and device control. The vulnerability in question affects the HFS (Hierarchical File System) implementation within the Linux kernel, which is used for reading and writing to HFS file systems. This vulnerability can lead to system crashes and instability, particularly when handling specific file system operations.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the hfs_find_init() method, which can lead to a general protection fault if the tree pointer is NULL. This issue may cause the system to crash, resulting in potential data loss or corruption. The vulnerability is triggered when the method attempts to access a null pointer, leading to a dereference of an invalid memory address. The crash is characterized by an error message indicating a general protection fault, which can disrupt normal operations and compromise system stability.
How To Fix
Minimum fixed version
6.12.43-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid operations that involve HFS file systems until the package is updated. This may include refraining from mounting HFS file systems or performing file operations that rely on the HFS implementation.
Conclusion
The vulnerability in the Linux kernel's HFS implementation poses a significant risk to system stability and data integrity. Users are strongly advised to update their packages to the latest patched versions to mitigate this risk. For those unable to update immediately, temporary workarounds should be employed to avoid potential crashes.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a general protection fault in the hfs_find_init() method of the Linux kernel, which can lead to system crashes.
You can check if your application is affected by using the Vulert playground at Vulert Scanner without any signup.
The consequences include potential system crashes, data loss, and instability when accessing HFS file systems.
Yes, the patched versions are 6.12.43-1 for Debian 13 and 6.16.3-1 for Debian 14.
If immediate updates are not possible, avoid using HFS file systems until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
