CVE-2025-38650hfsplus: remove mutex_lock check in hfsplus_free_extents
- 5.5MediumCVSS base score
- 0.15%Exploitation in 30 daysEPSS · top 96% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: hfsplus: remove mutex_lock check in hfsplus_free_extents Syzbot reported an issue in hfsplus filesystem: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 4400 at fs/hfsplus/extents.c:346 hfsplus_free_extents+0x700/0xad0 Call Trace: <TASK> hfsplus_file_truncate+0x768/0xbb0 fs/hfsplus/extents.c:606 hfsplus_write_begin+0xc2/0xd0 fs/hfsplus/inode.c:56 cont_expand_zero fs/buffer.c:2383 [inline] cont_write_begin+0x2cf/0x860 fs/buffer.c:2446 hfsplus_write_begin+0x86/0xd0 fs/hfsplus/inode.c:52 generic_cont_expand_simple+0x151/0x250 fs/buffer.c:2347 hfsplus_setattr+0x168/0x280 fs/hfsplus/inode.c:263 notify_change+0xe38/0x10f0 fs/attr.c:420 do_truncate+0x1fb/0x2e0 fs/open.c:65 do_sys_ftruncate+0x2eb/0x380 fs/open.c:193 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd To avoid deadlock, Commit 31651c607151 ("hfsplus: avoid deadlock on file truncation") unlock extree before hfsplus_free_extents(), and add check wheather extree is locked in hfsplus_free_extents(). However, when operations such as hfsplus_file_release, hfsplus_setattr, hfsplus_unlink, and hfsplus_get_block are executed concurrently in different files, it is very likely to trigger the WARN_ON, which will lead syzbot and xfstest to consider it as an abnormality. The comment above this warning also describes one of the easy triggering situations, which can easily trigger and cause xfstest&syzbot to report errors. [task A] [task B] ->hfsplus_file_release ->hfsplus_file_truncate ->hfs_find_init ->mutex_lock ->mutex_unlock ->hfsplus_write_begin ->hfsplus_get_block ->hfsplus_file_extend ->hfsplus_ext_read_extent ->hfs_find_init ->mutex_lock ->hfsplus_free_extents WARN_ON(mutex_is_locked) !!! Several threads could try to lock the shared extents tree. And warning can be triggered in one thread when another thread has locked the tree. This is the wrong behavior of the code and we need to remove the warning.
Timeline
ID reserved
By Linux
- 4 months later
· 4 months later
Published
- 9 months later
· 9 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.15% · top 96% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 31651c607151f1034cfb57e5a78678bea54c362b – < 0807e4ac59a546f2346961c5e26a98901594b205
- affected 31651c607151f1034cfb57e5a78678bea54c362b – < fdd6aca652122d6e97787e88d7dd53ddc8b74e7e
- affected 31651c607151f1034cfb57e5a78678bea54c362b – < 14922f0cc92e010b160121679c0a6ca072f4e975
- affected 31651c607151f1034cfb57e5a78678bea54c362b – < a19ce9230b22a0866313932e7964cf05557a6008
- affected 31651c607151f1034cfb57e5a78678bea54c362b – < 084933961ecda7561dedfb78c4676ccb90c91ada
- affected 31651c607151f1034cfb57e5a78678bea54c362b – < 5055b7db94110f228961dea6b74eed0a93a50b01
- affected 31651c607151f1034cfb57e5a78678bea54c362b – < 9764b8bb9f5f94df105cd2ac43829dd0d2c82b9f
- affected 31651c607151f1034cfb57e5a78678bea54c362b – < 314310166ba1fdff7660dfd9d18ea42d7058f7ae
- affected 31651c607151f1034cfb57e5a78678bea54c362b – < fcb96956c921f1aae7e7b477f2435c56f77a31b4
- affected 4.19
- unaffected < 4.19
- unaffected 5.4.297 – ≤ 5.4.*
- unaffected 5.10.241 – ≤ 5.10.*
- unaffected 5.15.190 – ≤ 5.15.*
- unaffected 6.1.148 – ≤ 6.1.*
- unaffected 6.6.102 – ≤ 6.6.*
- unaffected 6.12.42 – ≤ 6.12.*
- unaffected 6.15.10 – ≤ 6.15.*
- unaffected 6.16.1 – ≤ 6.16.*
- unaffected 6.17 – ≤ *
References
References11
- https://git.kernel.org/stable/c/0807e4ac59a546f2346961c5e26a98901594b205 (opens in a new tab)
- https://git.kernel.org/stable/c/fdd6aca652122d6e97787e88d7dd53ddc8b74e7e (opens in a new tab)
- https://git.kernel.org/stable/c/14922f0cc92e010b160121679c0a6ca072f4e975 (opens in a new tab)
- https://git.kernel.org/stable/c/a19ce9230b22a0866313932e7964cf05557a6008 (opens in a new tab)
- https://git.kernel.org/stable/c/084933961ecda7561dedfb78c4676ccb90c91ada (opens in a new tab)
- https://git.kernel.org/stable/c/5055b7db94110f228961dea6b74eed0a93a50b01 (opens in a new tab)
- https://git.kernel.org/stable/c/9764b8bb9f5f94df105cd2ac43829dd0d2c82b9f (opens in a new tab)
- https://git.kernel.org/stable/c/314310166ba1fdff7660dfd9d18ea42d7058f7ae (opens in a new tab)
- https://git.kernel.org/stable/c/fcb96956c921f1aae7e7b477f2435c56f77a31b4 (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-25552 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-38650)Record last updated .