Medium 5.5Published May 6, 2026

CVE-2025-71271hfsplus: ensure sb->s_fs_info is always cleaned up

Updated under an hour ago (Oct 26, 2026, 7:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: hfsplus: ensure sb->s_fs_info is always cleaned up When hfsplus was converted to the new mount api a bug was introduced by changing the allocation pattern of sb->s_fs_info. If setup_bdev_super() fails after a new superblock has been allocated by sget_fc(), but before hfsplus_fill_super() takes ownership of the filesystem-specific s_fs_info data it was leaked. Fix this by freeing sb->s_fs_info in hfsplus_kill_super().

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	432f7c78cb000a3151fa0d39585b000312f50d7e builds before 0bcfebb83b5460d5be4e5c9dfb19cdaf3d4cb1db; 432f7c78cb000a3151fa0d39585b000312f50d7e builds before 1e38d32bb04d85a2c81204a85a34878a497128c8; 432f7c78cb000a3151fa0d39585b000312f50d7e builds before 126fb0ce99431126b44a6c360192668c818f641f	CNA record
linux linux_kernel linux:linux_kernel	from 6.13 before 6.18.16; from 6.19 before 6.19.6	NVD

References

https://git.kernel.org/stable/c/0bcfebb83b5460d5be4e5c9dfb19cdaf3d4cb1dbpatch
https://git.kernel.org/stable/c/1e38d32bb04d85a2c81204a85a34878a497128c8patch
https://git.kernel.org/stable/c/126fb0ce99431126b44a6c360192668c818f641fpatch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.