CVE-2025-40244 in Linux
Riassunto
di VulDB • 20/06/2026
Based on the kernel log provided, here is an analysis of the crash and the likely root cause.
### **Summary** * **Error Type:** **KMSAN (Kernel Memory Sanitizer) Panic**. * **Root Cause:** The kernel detected the use of **uninitialized memory** in the `hfsplus` filesystem driver. * **Specific Function:** The crash originated in `__hfsplus_ext_cache_extent` (called during file extension/write operations). * **Taint Flag:** `[B]=BAD_PAGE` indicates that a bad page was detected, which is often a consequence of using uninitialized memory that corrupts page structures or metadata.
---
### **Detailed Analysis**
#### 1. **KMSAN Panic** * `kmsan.panic set ...`: KMSAN is a dynamic analysis tool that tracks uninitialized memory. When it detects that uninitialized memory is being used (e.g., read, copied, or passed to a function), it can trigger a panic if `kmsan.panic=1` is set. * `? __msan_warning+0x96/0x120`: This confirms that KMSAN intercepted an access to uninitialized memory.
#### 2. **Call Trace Analysis** The call trace shows the path leading to the error: 1. `vfs_write` → `generic_file_write_iter` → `generic_perform_write` → `hfsplus_write_begin` 2. `hfsplus_write_begin` calls `hfsplus_get_block` to allocate/get a block for writing. 3. `hfsplus_get_block` calls `hfsplus_file_extend` to extend the file if needed. 4. `hfsplus_file_extend` calls `__hfsplus_ext_cache_extent`. 5. **`__hfsplus_ext_cache_extent`** is where the uninitialized memory was accessed.
#### 3. **Likely Bug in `hfsplus`** The function `__hfsplus_ext_cache_extent` is likely reading a structure or variable that has not been properly initialized before use. Common causes in such scenarios include: * A local variable or struct member not being set before being read. * A buffer allocated with `kmalloc` (which does not zero memory) being used without explicit initialization. * A race condition where a field is read before it is written.
#### 4. **BAD_PAGE Taint** * `[B]=BAD_PAGE`: This taint flag suggests that the uninitialized memory access may have corrupted a page structure or led to an invalid page state. This is often a secondary effect of the KMSAN-detected bug.
---
### **Recommended Actions**
#### **For Developers/Kernel Maintainers:** 1. **Inspect `__hfsplus_ext_cache_extent`**: * Look for any variables or struct fields that are read but not initialized in this function. * Check if any `kmalloc`-allocated memory is used without `memset` or proper initialization. 2. **Check `hfsplus_file_extend`**: * Ensure that all data structures passed to or used within `__hfsplus_ext_cache_extent` are fully initialized before use. 3. **Reproduce with KMSAN**: * Since this was triggered by a repro (PID 9350, Comm: `repro`), use the same test case to verify the fix. 4. **Patch Example**: * If a local variable is used, ensure it is initialized: ```c struct some_struct s = {0}; // Zero-initialize
// or memset(&s, 0, sizeof(s)); ```
#### **For Users:** * This is a **kernel bug** in the `hfsplus` filesystem driver. * If you are not a developer, you can: * Avoid using HFS+ filesystems if possible. * Update your kernel to a newer version where this bug may have been fixed. * Report the bug to your distribution's kernel maintainers with the full log.
---
### **Conclusion** The kernel panic is caused by **uninitialized memory usage** in the `hfsplus` filesystem driver, specifically in the `__hfsplus_ext_cache_extent` function. This is a bug in the kernel code that needs to be fixed by initializing the relevant memory before use.
Once again VulDB remains the best source for vulnerability data.