CVE-2025-68761 (GCVE-0-2025-68761)

Vulnerability from cvelistv5 – Published: 2026-01-05 09:32 – Updated: 2026-08-05 12:11
VLAI
Title
hfs: fix potential use after free in hfs_correct_next_unused_CNID()
Summary
In the Linux kernel, the following vulnerability has been resolved: hfs: fix potential use after free in hfs_correct_next_unused_CNID() This code calls hfs_bnode_put(node) which drops the refcount and then dreferences "node" on the next line. It's only safe to use "node" when we're holding a reference so flip these two lines around.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a06ec283e125e334155fe13005c76c9f484ce759 , < 40a1e0142096dd7dd6cb5373841222b528698588 (git)
Affected: a06ec283e125e334155fe13005c76c9f484ce759 , < c105e76bb17cf4b55fe89c6ad4f6a0e3972b5b08 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.2 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/hfs/catalog.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "40a1e0142096dd7dd6cb5373841222b528698588",
              "status": "affected",
              "version": "a06ec283e125e334155fe13005c76c9f484ce759",
              "versionType": "git"
            },
            {
              "lessThan": "c105e76bb17cf4b55fe89c6ad4f6a0e3972b5b08",
              "status": "affected",
              "version": "a06ec283e125e334155fe13005c76c9f484ce759",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/hfs/catalog.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: fix potential use after free in hfs_correct_next_unused_CNID()\n\nThis code calls hfs_bnode_put(node) which drops the refcount and then\ndreferences \"node\" on the next line.  It\u0027s only safe to use \"node\"\nwhen we\u0027re holding a reference so flip these two lines around."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached locally through unlink, rmdir, or an overwriting rename on a writable, already-mounted HFS filesystem.\nAC:L - An attacker can create thread-only catalog tail nodes, repeatedly delete the highest-CNID object, induce reclaim pressure, and heap-spray the freed node; no condition fundamentally outside attacker control is required.\nPR:L - Mounting HFS requires CAP_SYS_ADMIN in the initial user namespace, but an ordinary user with write and search permission on an existing HFS directory can trigger the vulnerable deletion path.\nUI:N - The attacker directly invokes the filesystem operations, requiring no action by another user once a writable HFS volume is available.\nS:U - Exploitation compromises the host kernel within the same security authority and does not inherently cross a virtualization or comparable isolation boundary.\nC:H - Reclaim and heap spraying can replace the freed B-tree node, after which attacker-controlled tree and page fields may be dereferenced, supporting kernel-memory disclosure.\nI:H - The use-after-free can progress beyond the initial stale prev read into reuse of attacker-sprayed pointer, refcount, and lock fields, supporting arbitrary memory modification or control-flow hijacking.\nA:H - Dereferencing a reclaimed node can cause a kernel oops or panic, while a manipulated traversal can also loop or corrupt critical HFS state."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:21.089Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/40a1e0142096dd7dd6cb5373841222b528698588"
        },
        {
          "url": "https://git.kernel.org/stable/c/c105e76bb17cf4b55fe89c6ad4f6a0e3972b5b08"
        }
      ],
      "title": "hfs: fix potential use after free in hfs_correct_next_unused_CNID()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68761",
    "datePublished": "2026-01-05T09:32:33.814Z",
    "dateReserved": "2025-12-24T10:30:51.034Z",
    "dateUpdated": "2026-08-05T12:11:21.089Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68761",
      "date": "2026-10-01",
      "epss": "0.00131",
      "percentile": "0.02246"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/hfs/catalog.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "40a1e0142096dd7dd6cb5373841222b528698588",
                    "status": "affected",
                    "version": "a06ec283e125e334155fe13005c76c9f484ce759",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c105e76bb17cf4b55fe89c6ad4f6a0e3972b5b08",
                    "status": "affected",
                    "version": "a06ec283e125e334155fe13005c76c9f484ce759",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/hfs/catalog.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.18"
                  },
                  {
                    "lessThan": "6.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.19",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: fix potential use after free in hfs_correct_next_unused_CNID()\n\nThis code calls hfs_bnode_put(node) which drops the refcount and then\ndreferences \"node\" on the next line.  It\u0027s only safe to use \"node\"\nwhen we\u0027re holding a reference so flip these two lines around."
          }
        ],
        "id": "CVE-2025-68761",
        "lastModified": "2026-07-30T06:24:42.847",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-01-05T10:15:57.240",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/40a1e0142096dd7dd6cb5373841222b528698588"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c105e76bb17cf4b55fe89c6ad4f6a0e3972b5b08"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-21T11:43:57+00:00",
      "cve": "CVE-2025-68761",
      "id": "CVE-2025-68761",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Kernel: Privilege escalation via use-after-free in HFS filesystem",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68761.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-30T01:42:03Z",
      "cve": "CVE-2025-68761",
      "id": "CVE-2025-68761",
      "initial_release_date": "2026-01-06T00:24:01Z",
      "product_status:known_not_affected": "453",
      "product_status:recommended": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68761",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68761.json",
      "version": "13"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.