SECUFOCUSNOW
Home›CVE index›CVE-2025-40243
Review reviewHigh

CVE-2025-40243

Linux

In the Linux kernel, the following vulnerability has been resolved: hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() The syzbot reported issue in hfs_find_set_zero_bits(): ===================================================== BUG: KMSAN: uninit-value in hfs_find_set_zero_bits+0x74d/0xb60 fs/hfs/bitmap.c:45 hfs_find_set_zero_bits+0x74d/0xb60 fs/hfs/bitmap.c:45 hfs_vbm_search_free+0x13c/0x5b0 fs/hfs/bitmap.c:151 hfs_extend_file+0x6a5/0x1b00 fs/hfs/extent.c:408 hfs_get_block+0x435/0x1150 fs/hfs/extent.c:353 __block_write_begin_int+0xa76/0x3030 fs/buffer.c:2151 block_write_begin fs...

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2025.12.05
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() The syzbot reported issue in hfs_find_set_zero_bits(): ===================================================== BUG: KMSAN: uninit-value in hfs_find_set_zero_bits+0x74d/0xb60 fs/hfs/bitmap.c:45 hfs_find_set_zero_bits+0x74d/0xb60 fs/hfs/bitmap.c:45 hfs_vbm_search_free+0x13c/0x5b0 fs/hfs/bitmap.c:151 hfs_extend_file+0x6a5/0x1b00 fs/hfs/extent.c:408 hfs_get_block+0x435/0x1150 fs/hfs/extent.c:353 __block_write_begin_int+0xa76/0x3030 fs/buffer.c:2151 block_write_begin fs...

Affected product and versions

Product
Linux
Affected versions
>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < fc56548fca732f3d3692c83b40db796259a03887, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < bf1683078fbdd09a7f7f9b74121ebaa03432bd00, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2a112cdd66f5a132da5235ca31a320528c86bf33, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < e148ed5cda8fd96d4620c4622fb02f552a2d166a, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < cfafefcb0e1fc60135f7040f4aed0a4aef4f76ca, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 3b447fd401824e1ccf0b769188edefe866a1e676, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 502fa92a71f344611101bd04ef1a595b8b6014f5, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2048ec5b98dbdfe0b929d2e42dc7a54c389c53dd, >= 2.6.12
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available