Linux Kernel up to 6.18.10/6.19.0 hfs setup_bdev_super allocation of resources

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.18.10/6.19.0. It has been rated as critical. This affects the function setup_bdev_super of the component hfs. The manipulation leads to allocation of resources. This vulnerability is referenced as CVE-2025-71230. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.18.10/6.19.0. It has been rated as critical. This issue affects the function setup_bdev_super of the component hfs. The manipulation with an unknown input leads to a allocation of resources vulnerability. Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: hfs: ensure sb->s_fs_info is always cleaned up When hfs was converted to the new mount api a bug was introduced by changing the allocation pattern of sb->s_fs_info. If setup_bdev_super() fails after a new superblock has been allocated by sget_fc(), but before hfs_fill_super() takes ownership of the filesystem-specific s_fs_info data it was leaked. Fix this by freeing sb->s_fs_info in hfs_kill_super().

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2025-71230 since 02/18/2026. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 299447 (Linux Distros Unpatched Vulnerability : CVE-2025-71230), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.18.11 or 6.19.1 eliminates this vulnerability. Applying the patch 46c1d56ad321fb024761abd9af61a0cb616cf2f6/399219831514126bc9541e8eadefe02c6fbd9166 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (299447) and CERT Bund (WID-SEC-2026-0462). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9
• 6.10
• 6.11
• 6.12
• 6.13
• 6.14
• 6.15
• 6.16
• 6.17
• 6.18
• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.19.0

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion