CVE-2025-38650

MEDIUM EPSS 2.2%
Published Aug 22, 202510mo ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Aug 22, 2025 10mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: hfsplus: remove mutex_lock check in hfsplus_free_extents Syzbot reported an issue in hfsplus filesystem: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 4400 at fs/hfsplus/extents.c:346 hfsplus_free_extents+0x700/0xad0 Call Trace: <TASK> hfsplus_file_truncate+0x768/0xbb0 fs/hfsplus/extents.c:606 hfsplus_write_begin+0xc2/0xd0 fs/hfsplus/inode.c:56 cont_expand_zero fs/buffer.c:2383 [inline] cont_write_begin+0x2cf/0x860 fs/buffer.c:2446 hfsplus_write_begin+0x86/0xd0 fs/hfsplus/inode.c:52 generic_cont_expand_simple+0x151/0x250 fs/buffer.c:2347 hfsplus_setattr+0x168/0x280 fs/hfsplus/inode.c:263 notify_change+0xe38/0x10f0 fs/attr.c:420 do_truncate+0x1fb/0x2e0 fs/open.c:65 do_sys_ftruncate+0x2eb/0x380 fs/open.c:193 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd To avoid deadlock, Commit 31651c607151 ("hfsplus: avoid deadlock on file truncation") unlock extree before hfsplus_free_extents(), and add check wheather extree is locked in hfsplus_free_extents(). However, when operations such as hfsplus_file_release, hfsplus_setattr, hfsplus_unlink, and hfsplus_get_block are executed concurrently in different files, it is very likely to trigger the WARN_ON, which will lead syzbot and xfstest to consider it as an abnormality. The comment above this warning also describes one of the easy triggering situations, which can easily trigger and cause xfstest&syzbot to report errors. [task A] [task B] ->hfsplus_file_release ->hfsplus_file_truncate ->hfs_find_init ->mutex_lock ->mutex_unlock ->hfsplus_write_begin ->hfsplus_get_block ->hfsplus_file_extend ->hfsplus_ext_read_extent ->hfs_find_init ->mutex_lock ->hfsplus_free_extents WARN_ON(mutex_is_locked) !!! Several threads could try to lock the shared extents tree. And warning can be triggered in one thread when another thread has locked the tree. This is the wrong behavior of the code and we need to remove the warning.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
2.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-667

Affected Products 9

VendorProductVersionRange
linuxlinux_kernel*≥4.19  –  <5.4.297
linuxlinux_kernel*≥5.5  –  <5.10.241
linuxlinux_kernel*≥5.11  –  <5.15.190
linuxlinux_kernel*≥5.16  –  <6.1.148
linuxlinux_kernel*≥6.2  –  <6.6.102
linuxlinux_kernel*≥6.7  –  <6.12.42
linuxlinux_kernel*≥6.13  –  <6.15.10
linuxlinux_kernel*≥6.16  –  <6.16.1
debiandebian_linux11.0any

References 11

  • git.kernel.org https://git.kernel.org/stable/c/0807e4ac59a546f2346961c5e26a98901594b205
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/084933961ecda7561dedfb78c4676ccb90c91ada
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/14922f0cc92e010b160121679c0a6ca072f4e975
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/314310166ba1fdff7660dfd9d18ea42d7058f7ae
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5055b7db94110f228961dea6b74eed0a93a50b01
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9764b8bb9f5f94df105cd2ac43829dd0d2c82b9f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a19ce9230b22a0866313932e7964cf05557a6008
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fcb96956c921f1aae7e7b477f2435c56f77a31b4
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fdd6aca652122d6e97787e88d7dd53ddc8b74e7e
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
    Third Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
    Third Party Advisory

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/0807e4ac59a546f2346961c5e26a98901594b205
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/084933961ecda7561dedfb78c4676ccb90c91ada
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/14922f0cc92e010b160121679c0a6ca072f4e975
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/314310166ba1fdff7660dfd9d18ea42d7058f7ae
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/5055b7db94110f228961dea6b74eed0a93a50b01
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9764b8bb9f5f94df105cd2ac43829dd0d2c82b9f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a19ce9230b22a0866313932e7964cf05557a6008
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fcb96956c921f1aae7e7b477f2435c56f77a31b4
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/fdd6aca652122d6e97787e88d7dd53ddc8b74e7e
    Patch