CVE-2025-0927

Published: February 15, 2025Last modified: July 2, 2025

Description

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code.

Severity score breakdown

Notes

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Filesystem bugs due to corrupt images are not considered a CVE for any filesystem that is only mountable by CAP_SYS_ADMIN in the initial user namespace. That includes delegated mounting.

Status

References

• https://ssd-disclosure.com/ssd-advisory-linux-kernel-hfsplus-slab-out-of-bounds-write/
• https://ubuntu.com/security/CVE-2025-0927
• https://ubuntu.com/security/notices/USN-7276-1
• https://www.kernel.org/