SECUFOCUSNOW
Home›CVE index›CVE-2025-40088
Review reviewHigh

CVE-2025-40088

Linux

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() The hfsplus_strcasecmp() logic can trigger the issue: [ 117.317703][ T9855] ================================================================== [ 117.318353][ T9855] BUG: KASAN: slab-out-of-bounds in hfsplus_strcasecmp+0x1bc/0x490 [ 117.318991][ T9855] Read of size 2 at addr ffff88802160f40c by task repro/9855 [ 117.319577][ T9855] [ 117.319773][ T9855] CPU: 0 UID: 0 PID: 9855 Comm: repro Not tainted 6.17.0-rc6 #33 PREEMPT(full) [ 117.319780][ T9855] Hardware name:...

CVSS
7.1
EPSS
0.14%
3.84% percentile
CISA KEV
Not listed
Published
2025.10.30
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.14%
Technical severityCVSS 7.1

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() The hfsplus_strcasecmp() logic can trigger the issue: [ 117.317703][ T9855] ================================================================== [ 117.318353][ T9855] BUG: KASAN: slab-out-of-bounds in hfsplus_strcasecmp+0x1bc/0x490 [ 117.318991][ T9855] Read of size 2 at addr ffff88802160f40c by task repro/9855 [ 117.319577][ T9855] [ 117.319773][ T9855] CPU: 0 UID: 0 PID: 9855 Comm: repro Not tainted 6.17.0-rc6 #33 PREEMPT(full) [ 117.319780][ T9855] Hardware name:...

Affected product and versions

Product
Linux
Affected versions
>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 603158d4efa98a13a746bd586c20f194f4a31ec8, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ef250c3edd995d7bb5a5e5122ffad1c28a8686eb, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7ab44236b32ed41eb0636797e8e8e885a2f3b18a, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b47a75b6f762321f9eb6f31aab7bce47a37063b7, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 4f5ab4a9c6abd8b0d713cc2b7b041bc10d70f241, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 586c75dfd1d265c4150f6529debb85c9d62e101f, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 4bc081ba6c52b0c88c92701e3fbc33c7e2277afb, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 42520df65bf67189541a425f7d36b0b3e7bd7844, >= 2.6.12
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE
Not available
CVE-2025-40088 — Linux | SECUFOCUS NOW