{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2025-40349 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-40349 is a high-severity memory corruption vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-40349 and fix it if it is affected.\n\nWhat it is: CVE-2025-40349 is a high-severity memory corruption vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-40349 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-40349/ (Markdown: https://insights.sbomify.com/CVE-2025-40349/index.md)","id":"CVE-2025-40349","markdown":"https://insights.sbomify.com/CVE-2025-40349/index.md","name":"CVE-2025-40349","record":{"aliases":["BELL-CVE-2025-40349","DEBIAN-CVE-2025-40349","GHSA-fw43-f4rv-3fjg","ROOT-OS-UBUNTU-2404-CVE-2025-40349","UBUNTU-CVE-2025-40349"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A local attacker can cause a kernel crash via slab-out-of-bounds read in the HFS+ filesystem driver by triggering a specific allocation path.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: validate record offset in hfsplus_bmap_alloc\n\nhfsplus_bmap_alloc can trigger a crash if a\nrecord offset or length is larger than node_size\n\n[   15.264282] BUG: KASAN: slab-out-of-bounds in hfsplus_bmap_alloc+0x887/0x8b0\n[   15.265192] Read of size 8 at addr ffff8881085ca188 by task test/183\n[   15.265949]\n[   15.266163] CPU: 0 UID: 0 PID: 183 Comm: test Not tainted 6.17.0-rc2-gc17b750b3ad9 #14 PREEMPT(voluntary)\n[   15.266165] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   15.266167] Call Trace:\n[   15.266168]  \u003cTASK\u003e\n[   15.266169]  dump_stack_lvl+0x53/0x70\n[   15.266173]  print_report+0xd0/0x660\n[   15.266181]  kasan_report+0xce/0x100\n[   15.266185]  hfsplus_bmap_alloc+0x887/0x8b0\n[   15.266208]  hfs_btree_inc_height.isra.0+0xd5/0x7c0\n[   15.266217]  hfsplus_brec_insert+0x870/0xb00\n[   15.266222]  __hfsplus_ext_write_extent+0x428/0x570\n[   15.266225]  __hfsplus_ext_cache_extent+0x5e/0x910\n[   15.266227]  hfsplus_ext_read_extent+0x1b2/0x200\n[   15.266233]  hfsplus_file_extend+0x5a7/0x1000\n[   15.266237]  hfsplus_get_block+0x12b/0x8c0\n[   15.266238]  __block_write_begin_int+0x36b/0x12c0\n[   15.266251]  block_write_begin+0x77/0x110\n[   15.266252]  cont_write_begin+0x428/0x720\n[   15.266259]  hfsplus_write_begin+0x51/0x100\n[   15.266262]  cont_write_begin+0x272/0x720\n[   15.266270]  hfsplus_write_begin+0x51/0x100\n[   15.266274]  generic_perform_write+0x321/0x750\n[   15.266285]  generic_file_write_iter+0xc3/0x310\n[   15.266289]  __kernel_write_iter+0x2fd/0x800\n[   15.266296]  dump_user_range+0x2ea/0x910\n[   15.266301]  elf_core_dump+0x2a94/0x2ed0\n[   15.266320]  vfs_coredump+0x1d85/0x45e0\n[   15.266349]  get_signal+0x12e3/0x1990\n[   15.266357]  arch_do_signal_or_restart+0x89/0x580\n[   15.266362]  irqentry_exit_to_user_mode+0xab/0x110\n[   15.266364]  asm_exc_page_fault+0x26/0x30\n[   15.266366] RIP: 0033:0x41bd35\n[   15.266367] Code: bc d1 f3 0f 7f 27 f3 0f 7f 6f 10 f3 0f 7f 77 20 f3 0f 7f 7f 30 49 83 c0 0f 49 29 d0 48 8d 7c 17 31 e9 9f 0b 00 00 66 0f ef c0 \u003cf3\u003e 0f 6f 0e f3 0f 6f 56 10 66 0f 74 c1 66 0f d7 d0 49 83 f8f\n[   15.266369] RSP: 002b:00007ffc9e62d078 EFLAGS: 00010283\n[   15.266371] RAX: 00007ffc9e62d100 RBX: 0000000000000000 RCX: 0000000000000000\n[   15.266372] RDX: 00000000000000e0 RSI: 0000000000000000 RDI: 00007ffc9e62d100\n[   15.266373] RBP: 0000400000000040 R08: 00000000000000e0 R09: 0000000000000000\n[   15.266374] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n[   15.266375] R13: 0000000000000000 R14: 0000000000000000 R15: 0000400000000000\n[   15.266376]  \u003c/TASK\u003e\n\nWhen calling hfsplus_bmap_alloc to allocate a free node, this function\nfirst retrieves the bitmap from header node and map node using node-\u003epage\ntogether with the offset and length from hfs_brec_lenoff\n\n```\nlen = hfs_brec_lenoff(node, 2, \u0026off16);\noff = off16;\n\noff += node-\u003epage_offset;\npagep = node-\u003epage + (off \u003e\u003e PAGE_SHIFT);\ndata = kmap_local_page(*pagep);\n```\n\nHowever, if the retrieved offset or length is invalid(i.e. exceeds\nnode_size), the code may end up accessing pages outside the allocated\nrange for this node.\n\nThis patch adds proper validation of both offset and length before use,\npreventing out-of-bounds page access. Move is_bnode_offset_valid and\ncheck_and_correct_requested_length to hfsplus_fs.h, as they may be\nrequired by other functions.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"hfs: validate record offset in hfsplus_bmap_alloc","id":"CVE-2025-40349","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2025"},"n_packages":0,"n_references":8,"next":{"headline":"net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ","id":"CVE-2025-40350"},"packages":[],"prev":{"headline":"slab: Avoid race on slab-\u003eobj_exts in alloc_slab_obj_exts","id":"CVE-2025-40348"},"products":["Linux"],"published":"2025-12-16","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-08-05","vendors":["Linux"]},"summary":"A local attacker can cause a kernel crash via slab-out-of-bounds read in the HFS+ filesystem driver by triggering a specific allocation path.","url":"https://insights.sbomify.com/CVE-2025-40349/"}