{
  "cveId": "CVE-2025-40351",
  "url": "https://patchblox.com/security/cve/CVE-2025-40351",
  "summary": "CVE-2025-40351 is fixed in 19 products on 1 platform, first by DEBIAN-CVE-2025-40351, released December 16, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  hfsplus: fix KMSAN uninit-value issue in hfsplus...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()  The syzbot reported issue in hfsplus_delete_cat():  [   70.682285][ T9333] ===================================================== [   70.682943][ T9333] BUG: KMSAN: uninit-value in hfsplus_subfolders_dec\u002B0x1d7/0x220 [   70.683640][ T9333]  hfsplus_subfolders_dec\u002B0x1d7/0x220 [   70.684141][ T9333]  hfsplus_delete_cat\u002B0x105d/0x12b0 [   70.684621][ T9333]  hfsplus_rmdir\u002B0x13d/0x310 [   70.685048][ T9333]  vfs_rmdir\u002B0x5ba/0x810 [   70.685447][ T9333]  do_rmdir\u002B0x964/0xea0 [   70.685833][ T9333]  __x64_sys_rmdir\u002B0x71/0xb0 [   70.686260][ T9333]  x64_sys_call\u002B0xcd8/0x3cf0 [   70.686695][ T9333]  do_syscall_64\u002B0xd9/0x1d0 [   70.687119][ T9333]  entry_SYSCALL_64_after_hwframe\u002B0x77/0x7f [   70.687646][ T9333] [   70.687856][ T9333] Uninit was stored to memory at: [   70.688311][ T9333]  hfsplus_subfolders_inc\u002B0x1c2/0x1d0 [   70.688779][ T9333]  hfsplus_create_cat\u002B0x148e/0x1800 [   70.689231][ T9333]  hfsplus_mknod\u002B0x27f/0x600 [   70.689730][ T9333]  hfsplus_mkdir\u002B0x5a/0x70 [   70.690146][ T9333]  vfs_mkdir\u002B0x483/0x7a0 [   70.690545][ T9333]  do_mkdirat\u002B0x3f2/0xd30 [   70.690944][ T9333]  __x64_sys_mkdir\u002B0x9a/0xf0 [   70.691380][ T9333]  x64_sys_call\u002B0x2f89/0x3cf0 [   70.691816][ T9333]  do_syscall_64\u002B0xd9/0x1d0 [   70.692229][ T9333]  entry_SYSCALL_64_after_hwframe\u002B0x77/0x7f [   70.692773][ T9333] [   70.692990][ T9333] Uninit was stored to memory at: [   70.693469][ T9333]  hfsplus_subfolders_inc\u002B0x1c2/0x1d0 [   70.693960][ T9333]  hfsplus_create_cat\u002B0x148e/0x1800 [   70.694438][ T9333]  hfsplus_fill_super\u002B0x21c1/0x2700 [   70.694911][ T9333]  mount_bdev\u002B0x37b/0x530 [   70.695320][ T9333]  hfsplus_mount\u002B0x4d/0x60 [   70.695729][ T9333]  legacy_get_tree\u002B0x113/0x2c0 [   70.696167][ T9333]  vfs_get_tree\u002B0xb3/0x5c0 [   70.696588][ T9333]  do_new_mount\u002B0x73e/0x1630 [   70.697013][ T9333]  path_mount\u002B0x6e3/0x1eb0 [   70.697425][ T9333]  __se_sys_mount\u002B0x733/0x830 [   70.697857][ T9333]  __x64_sys_mount\u002B0xe4/0x150 [   70.698269][ T9333]  x64_sys_call\u002B0x2691/0x3cf0 [   70.698704][ T9333]  do_syscall_64\u002B0xd9/0x1d0 [   70.699117][ T9333]  entry_SYSCALL_64_after_hwframe\u002B0x77/0x7f [   70.699730][ T9333] [   70.699946][ T9333] Uninit was created at: [   70.700378][ T9333]  __alloc_pages_noprof\u002B0x714/0xe60 [   70.700843][ T9333]  alloc_pages_mpol_noprof\u002B0x2a2/0x9b0 [   70.701331][ T9333]  alloc_pages_noprof\u002B0xf8/0x1f0 [   70.701774][ T9333]  allocate_slab\u002B0x30e/0x1390 [   70.702194][ T9333]  ___slab_alloc\u002B0x1049/0x33a0 [   70.702635][ T9333]  kmem_cache_alloc_lru_noprof\u002B0x5ce/0xb20 [   70.703153][ T9333]  hfsplus_alloc_inode\u002B0x5a/0xd0 [   70.703598][ T9333]  alloc_inode\u002B0x82/0x490 [   70.703984][ T9333]  iget_locked\u002B0x22e/0x1320 [   70.704428][ T9333]  hfsplus_iget\u002B0x5c/0xba0 [   70.704827][ T9333]  hfsplus_btree_open\u002B0x135/0x1dd0 [   70.705291][ T9333]  hfsplus_fill_super\u002B0x1132/0x2700 [   70.705776][ T9333]  mount_bdev\u002B0x37b/0x530 [   70.706171][ T9333]  hfsplus_mount\u002B0x4d/0x60 [   70.706579][ T9333]  legacy_get_tree\u002B0x113/0x2c0 [   70.707019][ T9333]  vfs_get_tree\u002B0xb3/0x5c0 [   70.707444][ T9333]  do_new_mount\u002B0x73e/0x1630 [   70.707865][ T9333]  path_mount\u002B0x6e3/0x1eb0 [   70.708270][ T9333]  __se_sys_mount\u002B0x733/0x830 [   70.708711][ T9333]  __x64_sys_mount\u002B0xe4/0x150 [   70.709158][ T9333]  x64_sys_call\u002B0x2691/0x3cf0 [   70.709630][ T9333]  do_syscall_64\u002B0xd9/0x1d0 [   70.710053][ T9333]  entry_SYSCALL_64_after_hwframe\u002B0x77/0x7f [   70.710611][ T9333] [   70.710842][ T9333] CPU: 3 UID: 0 PID: 9333 Comm: repro Not tainted 6.12.0-rc6-dirty #17 [   70.711568][ T9333] Hardware name: QEMU Ubuntu 24.04 PC (i440FX \u002B PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [   70.712490][ T9333] ===================================================== [   70.713085][ T9333] Disabling lock debugging due to kernel taint [   70.713618][ T9333] Kernel panic - not syncing: kmsan.panic set ... [   70.714159][ T9333]  ---truncated---",
  "published": "2025-12-16T14:15:46Z",
  "severity": "",
  "epss": 0.00212,
  "epssPercentile": 0.115,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "dtb-aarch64",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-64kb",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-64kb",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.28.1",
      "fix": "SUSE-SU-2026:0315-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0315-1",
      "released": "2026-01-28T14:34:30Z"
    },
    {
      "platform": "linux",
      "product": "kernel-azure",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.20.24.1",
      "fix": "SUSE-SU-2026:0281-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0281-1",
      "released": "2026-01-23T16:03:47Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debug",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.28.1",
      "fix": "SUSE-SU-2026:0315-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0315-1",
      "released": "2026-01-28T14:34:30Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default-base",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1.150600.12.38.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default-base",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1.150600.12.38.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-default-base",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.28.1.150700.17.19.1",
      "fix": "SUSE-SU-2026:0315-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0315-1",
      "released": "2026-01-28T14:34:30Z"
    },
    {
      "platform": "linux",
      "product": "kernel-docs",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-docs",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-docs",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.28.1",
      "fix": "SUSE-SU-2026:0315-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0315-1",
      "released": "2026-01-28T14:34:30Z"
    },
    {
      "platform": "linux",
      "product": "kernel-kvmsmall",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-SLE15-SP6_Update_19",
      "release": "sles 15.6",
      "fixedVersion": "1-150600.13.3.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-SLE15-SP7-RT_Update_8",
      "release": "sles 15.7",
      "fixedVersion": "1-150700.1.3.1",
      "fix": "SUSE-SU-2026:0278-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0278-1",
      "released": "2026-01-23T15:08:32Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-SLE15-SP7_Update_8",
      "release": "sles 15.7",
      "fixedVersion": "1-150700.15.3.1",
      "fix": "SUSE-SU-2026:0315-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0315-1",
      "released": "2026-01-28T14:34:30Z"
    },
    {
      "platform": "linux",
      "product": "kernel-obs-build",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-obs-build",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-obs-build",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.28.1",
      "fix": "SUSE-SU-2026:0315-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0315-1",
      "released": "2026-01-28T14:34:30Z"
    },
    {
      "platform": "linux",
      "product": "kernel-obs-qa",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-source",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-source",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-source",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.28.1",
      "fix": "SUSE-SU-2026:0315-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0315-1",
      "released": "2026-01-28T14:34:30Z"
    },
    {
      "platform": "linux",
      "product": "kernel-source-azure",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.20.24.1",
      "fix": "SUSE-SU-2026:0281-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0281-1",
      "released": "2026-01-23T16:03:47Z"
    },
    {
      "platform": "linux",
      "product": "kernel-syms",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-syms",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-syms",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.28.1",
      "fix": "SUSE-SU-2026:0315-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0315-1",
      "released": "2026-01-28T14:34:30Z"
    },
    {
      "platform": "linux",
      "product": "kernel-syms-azure",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.20.24.1",
      "fix": "SUSE-SU-2026:0281-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0281-1",
      "released": "2026-01-23T16:03:47Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "6.4.0-150600.23.84.1",
      "fix": "SUSE-SU-2026:0293-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0293-1",
      "released": "2026-01-26T11:36:42Z"
    },
    {
      "platform": "linux",
      "product": "kernel-zfcpdump",
      "release": "sles 15.7",
      "fixedVersion": "6.4.0-150700.53.28.1",
      "fix": "SUSE-SU-2026:0315-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0315-1",
      "released": "2026-01-28T14:34:30Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.158-1",
      "fix": "DEBIAN-CVE-2025-40351",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-40351",
      "released": "2025-12-16T14:15:46Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.57-1",
      "fix": "DEBIAN-CVE-2025-40351",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-40351",
      "released": "2025-12-16T14:15:46Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.17.6-1",
      "fix": "DEBIAN-CVE-2025-40351",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-40351",
      "released": "2025-12-16T14:15:46Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}