{"schema_version":"1.9.0","id":"CVE-2025-38716","published":"2025-09-04T15:33:10.875Z","modified":"2026-08-12T03:51:10.825256912Z","summary":"hfs: fix general protection fault in hfs_find_init()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: fix general protection fault in hfs_find_init()\n\nThe hfs_find_init() method can trigger the crash\nif tree pointer is NULL:\n\n[   45.746290][ T9787] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KAI\n[   45.747287][ T9787] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]\n[   45.748716][ T9787] CPU: 2 UID: 0 PID: 9787 Comm: repro Not tainted 6.16.0-rc3 #10 PREEMPT(full)\n[   45.750250][ T9787] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   45.751983][ T9787] RIP: 0010:hfs_find_init+0x86/0x230\n[   45.752834][ T9787] Code: c1 ea 03 80 3c 02 00 0f 85 9a 01 00 00 4c 8d 6b 40 48 c7 45 18 00 00 00 00 48 b8 00 00 00 00 00 fc\n[   45.755574][ T9787] RSP: 0018:ffffc90015157668 EFLAGS: 00010202\n[   45.756432][ T9787] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff819a4d09\n[   45.757457][ T9787] RDX: 0000000000000008 RSI: ffffffff819acd3a RDI: ffffc900151576e8\n[   45.758282][ T9787] RBP: ffffc900151576d0 R08: 0000000000000005 R09: 0000000000000000\n[   45.758943][ T9787] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000004\n[   45.759619][ T9787] R13: 0000000000000040 R14: ffff88802c50814a R15: 0000000000000000\n[   45.760293][ T9787] FS:  00007ffb72734540(0000) GS:ffff8880cec64000(0000) knlGS:0000000000000000\n[   45.761050][ T9787] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   45.761606][ T9787] CR2: 00007f9bd8225000 CR3: 000000010979a000 CR4: 00000000000006f0\n[   45.762286][ T9787] Call Trace:\n[   45.762570][ T9787]  <TASK>\n[   45.762824][ T9787]  hfs_ext_read_extent+0x190/0x9d0\n[   45.763269][ T9787]  ? submit_bio_noacct_nocheck+0x2dd/0xce0\n[   45.763766][ T9787]  ? __pfx_hfs_ext_read_extent+0x10/0x10\n[   45.764250][ T9787]  hfs_get_block+0x55f/0x830\n[   45.764646][ T9787]  block_read_full_folio+0x36d/0x850\n[   45.765105][ T9787]  ? __pfx_hfs_get_block+0x10/0x10\n[   45.765541][ T9787]  ? const_folio_flags+0x5b/0x100\n[   45.765972][ T9787]  ? __pfx_hfs_read_folio+0x10/0x10\n[   45.766415][ T9787]  filemap_read_folio+0xbe/0x290\n[   45.766840][ T9787]  ? __pfx_filemap_read_folio+0x10/0x10\n[   45.767325][ T9787]  ? __filemap_get_folio+0x32b/0xbf0\n[   45.767780][ T9787]  do_read_cache_folio+0x263/0x5c0\n[   45.768223][ T9787]  ? __pfx_hfs_read_folio+0x10/0x10\n[   45.768666][ T9787]  read_cache_page+0x5b/0x160\n[   45.769070][ T9787]  hfs_btree_open+0x491/0x1740\n[   45.769481][ T9787]  hfs_mdb_get+0x15e2/0x1fb0\n[   45.769877][ T9787]  ? __pfx_hfs_mdb_get+0x10/0x10\n[   45.770316][ T9787]  ? find_held_lock+0x2b/0x80\n[   45.770731][ T9787]  ? lockdep_init_map_type+0x5c/0x280\n[   45.771200][ T9787]  ? lockdep_init_map_type+0x5c/0x280\n[   45.771674][ T9787]  hfs_fill_super+0x38e/0x720\n[   45.772092][ T9787]  ? __pfx_hfs_fill_super+0x10/0x10\n[   45.772549][ T9787]  ? snprintf+0xbe/0x100\n[   45.772931][ T9787]  ? __pfx_snprintf+0x10/0x10\n[   45.773350][ T9787]  ? do_raw_spin_lock+0x129/0x2b0\n[   45.773796][ T9787]  ? find_held_lock+0x2b/0x80\n[   45.774215][ T9787]  ? set_blocksize+0x40a/0x510\n[   45.774636][ T9787]  ? sb_set_blocksize+0x176/0x1d0\n[   45.775087][ T9787]  ? setup_bdev_super+0x369/0x730\n[   45.775533][ T9787]  get_tree_bdev_flags+0x384/0x620\n[   45.775985][ T9787]  ? __pfx_hfs_fill_super+0x10/0x10\n[   45.776453][ T9787]  ? __pfx_get_tree_bdev_flags+0x10/0x10\n[   45.776950][ T9787]  ? bpf_lsm_capable+0x9/0x10\n[   45.777365][ T9787]  ? security_capable+0x80/0x260\n[   45.777803][ T9787]  vfs_get_tree+0x8e/0x340\n[   45.778203][ T9787]  path_mount+0x13de/0x2010\n[   45.778604][ T9787]  ? kmem_cache_free+0x2b0/0x4c0\n[   45.779052][ T9787]  ? __pfx_path_mount+0x10/0x10\n[   45.779480][ T9787]  ? getname_flags.part.0+0x1c5/0x550\n[   45.779954][ T9787]  ? putname+0x154/0x1a0\n[   45.780335][ T9787]  __x64_sys_mount+0x27b/0x300\n[   45.780758][ T9787]  ? __pfx___x64_sys_mount+0x10/0x10\n[   45.781232][ T9787] \n---truncated---","affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"434a964daa14b9db083ce20404a4a2add54d037a"},{"fixed":"4f032979b63ad52e08aadf0faeac34ed35133ec0"},{"fixed":"5d8b249527362e0ccafcaf76b3bec2a0d2aa1498"},{"fixed":"b918c17a1934ac6309b0083f41d4e9d8fb3bb46c"},{"fixed":"6e20e10064fdc43231636fca519c15c013a8e3d6"},{"fixed":"736a0516a16268995f4898eded49bfef077af709"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0"},{"last_affected":"3db7e32f7521df6f9b64a9b04abb00dd11ca5735"},{"last_affected":"34456bfafc2743a19eb148d56502f9a8c0dc6fcc"},{"last_affected":"9d6b8fa025237243e1782c358c83f20062d39fbe"},{"last_affected":"70f2545d9e75f9d8ed4bfe0a6efa232abd88806e"},{"last_affected":"9f0f2bb728f4e87568f89a5603f7d3b76ef6a3b9"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2.6.27.60"},{"fixed":"2.6.28"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2.6.32.51"},{"fixed":"2.6.33"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2.6.34.14"},{"fixed":"2.6.35"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3.0.14"},{"fixed":"3.1"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3.1.6"},{"fixed":"3.2"}]}],"versions":["v2.6.34.13","v2.6.34.12","v2.6.34.11","v2.6.34.10","v2.6.27.59","v2.6.32.50","v3.1.5","v3.0.13","v3.1","v2.6.32.49","v3.1.4","v3.0.12","v3.1.3","v3.0.11","v2.6.32.48","v3.0.10","v3.1.2","v3.1.1","v3.0.9","v3.0.8","v2.6.32.47","v2.6.32.46","v3.1-rc1","v3.1-rc9","v3.1-rc8","v3.0.7","v3.1-rc10","v3.1-rc7","v3.0.6","v3.1-rc3","v3.1-rc2","v3.0.5","v3.0.4","v3.1-rc4","v3.1-rc5","v3.0","v3.1-rc6","v2.6.32.45","v3.0.3","v3.0.2","v2.6.32.44","v3.0.1","v2.6.32.43","v3.0-rc7","v3.0-rc4","v3.0-rc6","v3.0-rc5","v2.6.32.42","v3.0-rc3","v3.0-rc1","v2.6.39","v3.0-rc2","v2.6.34.9","v2.6.32.41","v2.6.38","v2.6.39-rc2","v2.6.32.40","v2.6.39-rc7","v2.6.39-rc5","v2.6.39-rc1","v2.6.38-rc7","v2.6.39-rc6","v2.6.32.39","v2.6.39-rc4","v2.6.27.58","v2.6.32.38","v2.6.39-rc3","v2.6.34.8","v2.6.32.37","v2.6.37","v2.6.32.36","v2.6.32.35","v2.6.32.34","v2.6.32.33","v2.6.38-rc1","v2.6.38-rc8","v2.6.32.32","v2.6.38-rc2","v2.6.38-rc6","v2.6.32.31","v2.6.38-rc5","v2.6.38-rc4","v2.6.32.30","v2.6.32.29","v2.6.32.28","v2.6.38-rc3","v2.6.27.57","v2.6.37-rc4","v2.6.37-rc2","v2.6.36","v2.6.32.27","v2.6.37-rc5","v2.6.34.7","v2.6.37-rc8","v2.6.37-rc7","v2.6.37-rc6","v2.6.37-rc1","v2.6.32.26","v2.6.27.56","v2.6.37-rc3","v2.6.32.25","v2.6.27.55","v2.6.32.24","v2.6.27.54","v2.6.36-rc6","v2.6.35-rc4","v2.6.36-rc8","v2.6.35","v2.6.36-rc7","v2.6.36-rc3","v2.6.36-rc5","v2.6.32.23","v2.6.36-rc4","v2.6.32.22","v2.6.32.21","v2.6.27.53","v2.6.34.6","v2.6.36-rc2","v2.6.36-rc1","v2.6.34.5","v2.6.32.20","v2.6.27.52","v2.6.34.4","v2.6.32.19","v2.6.27.51","v2.6.27.50","v2.6.34.3","v2.6.32.18","v2.6.32.17","v2.6.27.49","v2.6.34.2","v2.6.35-rc5","v2.6.34.1","v2.6.32.16","v2.6.27.48","v2.6.35-rc6","v2.6.34","v2.6.35-rc3","v2.6.35-rc1","v2.6.32.15","v2.6.27.47","v2.6.35-rc2","v2.6.32.14","v2.6.27.46","v2.6.34-rc7","v2.6.32.13","v2.6.32.12","v2.6.34-rc6","v2.6.34-rc5","v2.6.34-rc4","v2.6.32.11","v2.6.34-rc3","v2.6.34-rc2","v2.6.32.10","v2.6.27.45","v2.6.34-rc1","v2.6.33","v2.6.32.9","v2.6.33-rc6","v2.6.33-rc8","v2.6.32.8","v2.6.33-rc4","v2.6.33-rc5","v2.6.33-rc3","v2.6.33-rc7","v2.6.32.7","v2.6.27.44","v2.6.32.6","v2.6.32.5","v2.6.33-rc2","v2.6.32.4","v2.6.27.43","v2.6.32.3","v2.6.32","v2.6.27.42","v2.6.32.2","v2.6.33-rc1","v2.6.32.1","v2.6.27.41","v2.6.27.40","v2.6.27.39","v2.6.32-rc8","v2.6.32-rc7","v2.6.32-rc6","v2.6.27.38","v2.6.31","v2.6.32-rc5","v2.6.32-rc4","v2.6.32-rc2","v2.6.32-rc1","v2.6.32-rc3","v2.6.27.37","v2.6.27.36","v2.6.27.35","v2.6.27.34","v2.6.27.33","v2.6.31-rc9","v2.6.27.32","v2.6.27.31","v2.6.31-rc1","v2.6.31-rc7","v2.6.31-rc8","v2.6.31-rc6","v2.6.30-rc6","v2.6.30","v2.6.27.30","v2.6.27.29","v2.6.31-rc4","v2.6.31-rc5","v2.6.27.28","v2.6.27.27","v2.6.31-rc3","v2.6.27.26","v2.6.31-rc2","v2.6.27.25","v2.6.27.24","v2.6.30-rc7","v2.6.30-rc8","v2.6.30-rc5","v2.6.27.23","v2.6.30-rc3","v2.6.27.22","v2.6.30-rc4","v2.6.27.21","v2.6.30-rc1","v2.6.30-rc2","v2.6.29","v2.6.29-rc8","v2.6.27.20","v2.6.29-rc7","v2.6.27.19","v2.6.29-rc5","v2.6.29-rc1","v2.6.29-rc6","v2.6.27.18","v2.6.27.17","v2.6.27.16","v2.6.27.15","v2.6.29-rc4","v2.6.29-rc3","v2.6.27.14","v2.6.27.13","v2.6.29-rc2","v2.6.27.12","v2.6.28","v2.6.27.11","v2.6.27.10","v2.6.28-rc7","v2.6.28-rc9","v2.6.28-rc8","v2.6.28-rc6","v2.6.27.9","v2.6.27.8","v2.6.27.7","v2.6.28-rc5","v2.6.27.6","v2.6.27.5","v2.6.28-rc4","v2.6.28-rc2","v2.6.27.4","v2.6.28-rc3","v2.6.28-rc1","v2.6.27.3","v2.6.27","v2.6.27.2","v2.6.27.1","v2.6.27-rc7","v2.6.27-rc9","v2.6.27-rc8","v2.6.27-rc5","v2.6.27-rc6","v2.6.27-rc4","v2.6.27-rc1","v2.6.27-rc3","v2.6.27-rc2","v2.6.26","v2.6.26-rc9","v2.6.26-rc8","v2.6.26-rc3","v2.6.26-rc7","v2.6.26-rc6","v2.6.26-rc5","v2.6.26-rc4","v2.6.26-rc2","v2.6.26-rc1","v2.6.25","v2.6.25-rc7","v2.6.25-rc9","v2.6.25-rc8","v2.6.25-rc6","v2.6.25-rc5","v2.6.25-rc3","v2.6.25-rc4","v2.6.24","v2.6.25-rc2","v2.6.25-rc1","v2.6.24-rc8","v2.6.24-rc7","v2.6.24-rc6","v2.6.24-rc5","v2.6.24-rc4","v2.6.24-rc3","v2.6.24-rc2","v2.6.24-rc1","v2.6.23","v2.6.23-rc9","v2.6.23-rc8","v2.6.23-rc5","v2.6.23-rc7","v2.6.23-rc6","v2.6.23-rc4","v2.6.23-rc3","v2.6.23-rc2","v2.6.23-rc1","v2.6.22","v2.6.22-rc7","v2.6.22-rc6","v2.6.22-rc5","v2.6.22-rc4","v2.6.22-rc3","v2.6.22-rc2","v2.6.22-rc1","v2.6.21","v2.6.21-rc7","v2.6.21-rc6","v2.6.21-rc5","v2.6.21-rc4","v2.6.21-rc3","v2.6.21-rc2","v2.6.21-rc1","v2.6.20-rc7","v2.6.20-rc6","v2.6.20-rc5","v2.6.20-rc4","v2.6.20-rc3","v2.6.20-rc1","v2.6.20-rc2","v2.6.19-rc2","v2.6.18","v2.6.19-rc1","v2.6.18-rc6","v2.6.18-rc5","v2.6.18-rc3","v2.6.18-rc2","v2.6.18-rc1","v2.6.17","v2.6.17-rc4","v2.6.17-rc6","v2.6.17-rc5","v2.6.17-rc3","v2.6.17-rc2","v2.6.17-rc1","v2.6.16","v2.6.16-rc6","v2.6.16-rc4","v2.6.16-rc5","v2.6.16-rc3","v2.6.16-rc2","v2.6.16-rc1","v2.6.15-rc7","v2.6.15-rc5","v2.6.15-rc4","v2.6.15-rc2","v2.6.15-rc1","v2.6.14-rc3","v2.6.14-rc2","v2.6.14-rc1","v2.6.13","v2.6.13-rc7","v2.6.13-rc6","v2.6.13-rc5","v2.6.13-rc3","v2.6.13-rc4","v2.6.13-rc2","v2.6.13-rc1","v2.6.12-rc4","v2.6.12-rc3","v2.6.12-rc2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38716.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"6.6.103"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.43"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.15.11"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.16.0"},{"fixed":"6.16.2"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38716.json"}}],"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/4f032979b63ad52e08aadf0faeac34ed35133ec0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5d8b249527362e0ccafcaf76b3bec2a0d2aa1498"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6e20e10064fdc43231636fca519c15c013a8e3d6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/736a0516a16268995f4898eded49bfef077af709"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b918c17a1934ac6309b0083f41d4e9d8fb3bb46c"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38716.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38716"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38716.json"}}