Medium 5.5Published Feb 18, 2026

CVE-2025-71230hfs: ensure sb->s_fs_info is always cleaned up

Updated under an hour ago (Oct 27, 2026, 3:10 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: hfs: ensure sb->s_fs_info is always cleaned up When hfs was converted to the new mount api a bug was introduced by changing the allocation pattern of sb->s_fs_info. If setup_bdev_super() fails after a new superblock has been allocated by sget_fc(), but before hfs_fill_super() takes ownership of the filesystem-specific s_fs_info data it was leaked. Fix this by freeing sb->s_fs_info in hfs_kill_super().

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ffcd06b6d13b72823aba0d7c871f7e4876e7916b before 46c1d56ad321fb024761abd9af61a0cb616cf2f6; from ffcd06b6d13b72823aba0d7c871f7e4876e7916b before 399219831514126bc9541e8eadefe02c6fbd9166; from ffcd06b6d13b72823aba0d7c871f7e4876e7916b before 05ce49a902be15dc93854cbfc20161205a9ee446	CNA record
linux linux_kernel linux:linux_kernel	from 6.13 before 6.18.11; from 6.19 before 6.19.1	NVD

References

References

https://git.kernel.org/stable/c/46c1d56ad321fb024761abd9af61a0cb616cf2f6	patch
https://git.kernel.org/stable/c/399219831514126bc9541e8eadefe02c6fbd9166	patch
https://git.kernel.org/stable/c/05ce49a902be15dc93854cbfc20161205a9ee446	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.