Medium 5.5Published Sep 4, 2025

CVE-2025-38712hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()

Updated under an hour ago (Oct 27, 2026, 5:10 PM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplus_fill_super() assumes that the attributes file is not yet created, which later results in hitting BUG_ON() when hfsplus_create_attributes_file() is called. Replace this BUG_ON() with -EIO error with a message to suggest running fsck tool.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: May 12, 2026
First seen by InfoSec Signals: Oct 19, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 95e0d7dbb9b28ab0dfad7c7316066b05e1f1d4cd before bb0eea8e375677f586ad11c12e2525ed3fc698c2; from 95e0d7dbb9b28ab0dfad7c7316066b05e1f1d4cd before 9046566fa692f88954dac8c510f37ee17a15fdb7; 95e0d7dbb9b28ab0dfad7c7316066b05e1f1d4cd builds before 03cd1db1494cf930e2fa042c9c13e32bffdb4eba; from 95e0d7dbb9b28ab0dfad7c7316066b05e1f1d4cd before dee5c668ad71ddbcb4b48d95e8a4f371314ad41d; from 95e0d7dbb9b28ab0dfad7c7316066b05e1f1d4cd before b3359392b75395a31af739a761f48f4041148226; 95e0d7dbb9b28ab0dfad7c7316066b05e1f1d4cd builds before 1bb8da27ff15e346d4bc9e248e819c9a88ebf9d6; from 95e0d7dbb9b28ab0dfad7c7316066b05e1f1d4cd before d768e3ed430e89a699bf89d3214dcbbf4648c939; from 95e0d7dbb9b28ab0dfad7c7316066b05e1f1d4cd before ce5e387f396cbb5c061d9837abcac731e9e06f4d; and 1 more ranges	CNA record
Siemens SIMATIC CN 4100 siemens:simatic_cn_4100 (from the name)	before V5.0	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.13 before 5.4.297; from 5.5 before 5.10.241; from 5.11 before 5.15.190; from 5.16 before 6.1.149; from 6.2 before 6.6.103; from 6.7 before 6.12.43; from 6.13 before 6.15.11; from 6.16 before 6.16.2	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/bb0eea8e375677f586ad11c12e2525ed3fc698c2	patch
https://git.kernel.org/stable/c/9046566fa692f88954dac8c510f37ee17a15fdb7	patch
https://git.kernel.org/stable/c/03cd1db1494cf930e2fa042c9c13e32bffdb4eba	patch
https://git.kernel.org/stable/c/dee5c668ad71ddbcb4b48d95e8a4f371314ad41d	patch
https://git.kernel.org/stable/c/b3359392b75395a31af739a761f48f4041148226	patch
https://git.kernel.org/stable/c/1bb8da27ff15e346d4bc9e248e819c9a88ebf9d6	patch
https://git.kernel.org/stable/c/d768e3ed430e89a699bf89d3214dcbbf4648c939	patch
https://git.kernel.org/stable/c/ce5e387f396cbb5c061d9837abcac731e9e06f4d	patch
https://git.kernel.org/stable/c/c7c6363ca186747ebc2df10c8a1a51e66e0e32d9	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html	mailing-list, third-party-advisory
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.