In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc(): [ 667.121659][ T9805] ================================================================== [ 667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10 [ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full) [ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.124890][ T9805] Call Trace: [ 667.124893][ T9805] <TASK> [ 667.124896][ T9805] dump_stack_lvl+0x10e/0x1f0 [ 667.124911][ T9805] print_report+0xd0/0x660 [ 667.124920][ T9805] ? __virt_addr_valid+0x81/0x610 [ 667.124928][ T9805] ? __phys_addr+0xe8/0x180 [ 667.124934][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124942][ T9805] kasan_report+0xc6/0x100 [ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124959][ T9805] hfsplus_uni2asc+0x902/0xa10 [ 667.124966][ T9805] ? hfsplus_bnode_read+0x14b/0x360 [ 667.124974][ T9805] hfsplus_readdir+0x845/0xfc0 [ 667.124984][ T9805] ? __pfx_hfsplus_readdir+0x10/0x10 [ 667.124994][ T9805] ? stack_trace_save+0x8e/0xc0 [ 667.125008][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125015][ T9805] ? trace_lock_acquire+0x85/0xd0 [ 667.125022][ T9805] ? lock_acquire+0x30/0x80 [ 667.125029][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125037][ T9805] ? down_read_killable+0x1ed/0x4c0 [ 667.125044][ T9805] ? putname+0x154/0x1a0 [ 667.125051][ T9805] ? __pfx_down_read_killable+0x10/0x10 [ 667.125058][ T9805] ? apparmor_file_permission+0x239/0x3e0 [ 667.125069][ T9805] iterate_dir+0x296/0xb20 [ 667.125076][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.125084][ T9805] ? __pfx___x64_sys_getdents64+0x10/0x10 [ 667.125091][ T9805] ? __x64_sys_openat+0x141/0x200 [ 667.125126][ T9805] ? __pfx_filldir64+0x10/0x10 [ 667.125134][ T9805] ? do_user_addr_fault+0x7fe/0x12f0 [ 667.125143][ T9805] do_syscall_64+0xc9/0x480 [ 667.125151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9 [ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9 [ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9 [ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004 [ 667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110 [ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.125207][ T9805] </TASK> [ 667.125210][ T9805] [ 667.145632][ T9805] Allocated by task 9805: [ 667.145991][ T9805] kasan_save_stack+0x20/0x40 [ 667.146352][ T9805] kasan_save_track+0x14/0x30 [ 667.146717][ T9805] __kasan_kmalloc+0xaa/0xb0 [ 667.147065][ T9805] __kmalloc_noprof+0x205/0x550 [ 667.147448][ T9805] hfsplus_find_init+0x95/0x1f0 [ 667.147813][ T9805] hfsplus_readdir+0x220/0xfc0 [ 667.148174][ T9805] iterate_dir+0x296/0xb20 [ 667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.148937][ T9805] do_syscall_64+0xc9/0x480 [ 667.149291][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.149809][ T9805] [ 667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000 [ 667.150030][ T9805] which belongs to the cache kmalloc-2k of size 2048 [ 667.151282][ T9805] The buggy address is located 0 bytes to the right of [ 667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c) [ 667.1 ---truncated---

The version of kernel installed on the remote host is prior to 4.14.355-280.695. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3013 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    iavf: Fix reset error handling (CVE-2022-50053)

    In the Linux kernel, the following vulnerability has been resolved:

    module: ensure that kobject_put() is safe for module type kobjects (CVE-2025-37995)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPICA: Refuse to evaluate a method if arguments are missing (CVE-2025-38386)

    In the Linux kernel, the following vulnerability has been resolved:

    Squashfs: check return result of sb_min_blocksize (CVE-2025-38415)

    In the Linux kernel, the following vulnerability has been resolved:

    tipc: Fix use-after-free in tipc_conn_close(). (CVE-2025-38464)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: reject malicious packets in ipv6_gso_segment() (CVE-2025-38572)

    In the Linux kernel, the following vulnerability has been resolved:

    can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode (CVE-2025-38665)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (CVE-2025-38700)

    In the Linux kernel, the following vulnerability has been resolved:

    hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (CVE-2025-38713)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Also allocate and copy hash for reading of filter files (CVE-2025-39689)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6009 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6009-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     September 22, 2025                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : linux     CVE ID         : CVE-2024-47704 CVE-2024-57924 CVE-2024-58240 CVE-2025-23143                      CVE-2025-23160 CVE-2025-37931 CVE-2025-37968 CVE-2025-38322                      CVE-2025-38347 CVE-2025-38491 CVE-2025-38502 CVE-2025-38552                      CVE-2025-38614 CVE-2025-38670 CVE-2025-38676 CVE-2025-38677                      CVE-2025-38679 CVE-2025-38680 CVE-2025-38681 CVE-2025-38683                      CVE-2025-38684 CVE-2025-38685 CVE-2025-38687 CVE-2025-38691                      CVE-2025-38693 CVE-2025-38694 CVE-2025-38695 CVE-2025-38696                      CVE-2025-38697 CVE-2025-38698 CVE-2025-38699 CVE-2025-38700                      CVE-2025-38701 CVE-2025-38702 CVE-2025-38706 CVE-2025-38707                      CVE-2025-38708 CVE-2025-38711 CVE-2025-38712 CVE-2025-38713                      CVE-2025-38714 CVE-2025-38715 CVE-2025-38721 CVE-2025-38723                      CVE-2025-38724 CVE-2025-38725 CVE-2025-38727 CVE-2025-38728                      CVE-2025-38729 CVE-2025-38732 CVE-2025-38735 CVE-2025-38736                      CVE-2025-39673 CVE-2025-39675 CVE-2025-39676 CVE-2025-39681                      CVE-2025-39682 CVE-2025-39683 CVE-2025-39684 CVE-2025-39685                      CVE-2025-39686 CVE-2025-39687 CVE-2025-39689 CVE-2025-39691                      CVE-2025-39692 CVE-2025-39693 CVE-2025-39694 CVE-2025-39697                      CVE-2025-39701 CVE-2025-39702 CVE-2025-39703 CVE-2025-39706                      CVE-2025-39709 CVE-2025-39710 CVE-2025-39713 CVE-2025-39714                      CVE-2025-39715 CVE-2025-39716 CVE-2025-39718 CVE-2025-39719                      CVE-2025-39724 CVE-2025-39736 CVE-2025-39737 CVE-2025-39738                      CVE-2025-39742 CVE-2025-39743 CVE-2025-39749 CVE-2025-39751                      CVE-2025-39752 CVE-2025-39756 CVE-2025-39757 CVE-2025-39759                      CVE-2025-39760 CVE-2025-39766 CVE-2025-39770 CVE-2025-39772                      CVE-2025-39773 CVE-2025-39776 CVE-2025-39782 CVE-2025-39783                      CVE-2025-39787 CVE-2025-39788 CVE-2025-39790 CVE-2025-39794                      CVE-2025-39795 CVE-2025-39798 CVE-2025-39800 CVE-2025-39801                      CVE-2025-39806 CVE-2025-39808 CVE-2025-39812 CVE-2025-39813                      CVE-2025-39817 CVE-2025-39819 CVE-2025-39823 CVE-2025-39824                      CVE-2025-39825 CVE-2025-39826 CVE-2025-39827 CVE-2025-39828                      CVE-2025-39835 CVE-2025-39838 CVE-2025-39839 CVE-2025-39841                      CVE-2025-39842 CVE-2025-39843 CVE-2025-39844 CVE-2025-39845                      CVE-2025-39846 CVE-2025-39847 CVE-2025-39848 CVE-2025-39849                      CVE-2025-39853 CVE-2025-39857 CVE-2025-39860 CVE-2025-39864                      CVE-2025-39865 CVE-2025-39866 CVE-2025-40300

    Several vulnerabilities have been discovered in the Linux kernel that     may lead to a privilege escalation, denial of service or information     leaks.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 6.1.153-1.

    We recommend that you upgrade your linux packages.

    For the detailed security status of linux please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/linux

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The version of kernel installed on the remote host is prior to 5.10.242-239.961. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-104 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    btrfs: fix deadlock when cloning inline extents and using qgroups (CVE-2021-46987)

    In the Linux kernel, the following vulnerability has been resolved:

    uio_hv_generic: Fix another memory leak in error handling paths (CVE-2021-47070)

    In the Linux kernel, the following vulnerability has been resolved:

    RDMA/rxe: Return CQE error if invalid lkey was supplied (CVE-2021-47076)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Fix link down processing to address NULL pointer dereference (CVE-2021-47183)

    In the Linux kernel, the following vulnerability has been resolved:

    block: don't call rq_qos_ops->done_bio if the bio isn't tracked (CVE-2021-47412)

    In the Linux kernel, the following vulnerability has been resolved:

    ptp: Fix possible memory leak in ptp_clock_register() (CVE-2021-47455)

    In the Linux kernel, the following vulnerability has been resolved:

    dm rq: don't queue request to blk-mq during DM suspend (CVE-2021-47498)

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (CVE-2022-50327)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix UAF in decryption with multichannel (CVE-2025-37750)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-net: ensure the received length does not exceed allocated size (CVE-2025-38375)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: net: sierra: check for no status endpoint (CVE-2025-38474)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_qfq: Fix race condition on qfq_aggregate (CVE-2025-38477)

    In the Linux kernel, the following vulnerability has been resolved:

    smb: client: fix use-after-free in crypt_message when using async crypto (CVE-2025-38488)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: do not bypass hid_hw_raw_request (CVE-2025-38494)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: ensure the allocated report buffer can contain the reserved report ID (CVE-2025-38495)

    In the Linux kernel, the following vulnerability has been resolved:

    clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (CVE-2025-38499)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Restrict conditions for adding duplicating netems to qdisc tree (CVE-2025-38553)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: reject malicious packets in ipv6_gso_segment() (CVE-2025-38572)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: fix a race in packet_set_ring() and packet_notifier() (CVE-2025-38617)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: Do not allow binding to VMADDR_PORT_ANY (CVE-2025-38618)

    In the Linux kernel, the following vulnerability has been resolved:

    net: drop UFO packets in udp_rcv_segment() (CVE-2025-38622)

    In the Linux kernel, the following vulnerability has been resolved:

    hfsplus: remove mutex_lock check in hfsplus_free_extents (CVE-2025-38650)

    In the Linux kernel, the following vulnerability has been resolved:

    regulator: core: fix NULL dereference on unbind due to stale coupling data (CVE-2025-38668)

    In the Linux kernel, the following vulnerability has been resolved:

    hv_netvsc: Fix panic during namespace deletion with VF (CVE-2025-38683)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: ets: use old 'nbands' while purging unused classes (CVE-2025-38684)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (CVE-2025-38695)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (CVE-2025-38700)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (CVE-2025-38701)

    In the Linux kernel, the following vulnerability has been resolved:

    hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (CVE-2025-38713)

    In the Linux kernel, the following vulnerability has been resolved:

    hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (CVE-2025-38714)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: nf_reject: don't leak dst refcount for loopback packets (CVE-2025-38732)

    In the Linux kernel, the following vulnerability has been resolved:

    tracing: Limit access to parser->buffer when trace_get_user failed (CVE-2025-39683)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Also allocate and copy hash for reading of filter files (CVE-2025-39689)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/buffer: fix use-after-free when call bh_read() helper (CVE-2025-39691)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix a race when updating an existing write (CVE-2025-39697)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766)

    In the Linux kernel, the following vulnerability has been resolved:

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: use array_index_nospec with indices that come from guest (CVE-2025-39823)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: asus: fix UAF via HID_CLAIMED_INPUT validation (CVE-2025-39824)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.4.298-218.429. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2025-109 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value (CVE-2022-50327)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix UAF in cifs_demultiplex_thread() (CVE-2023-52572)

    In the Linux kernel, the following vulnerability has been resolved:

    nfs: fix UAF in direct writes (CVE-2024-26958)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: don't allow 1 packet limit (CVE-2024-57996)

    In the Linux kernel, the following vulnerability has been resolved:

    codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CVE-2025-37798)

    In the Linux kernel, the following vulnerability has been resolved:

    dma-buf: insert memory barrier before updating num_fences (CVE-2025-38095)

    In the Linux kernel, the following vulnerability has been resolved:

    sch_hfsc: make hfsc_qlen_notify() idempotent (CVE-2025-38177)

    In the Linux kernel, the following vulnerability has been resolved:

    net_sched: sch_sfq: reject invalid perturb period (CVE-2025-38193)

    In the Linux kernel, the following vulnerability has been resolved:

    virtio-net: ensure the received length does not exceed allocated size (CVE-2025-38375)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: net: sierra: check for no status endpoint (CVE-2025-38474)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: sch_qfq: Fix race condition on qfq_aggregate (CVE-2025-38477)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: do not bypass hid_hw_raw_request (CVE-2025-38494)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: core: ensure the allocated report buffer can contain the reserved report ID (CVE-2025-38495)

    In the Linux kernel, the following vulnerability has been resolved:

    clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (CVE-2025-38499)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Restrict conditions for adding duplicating netems to qdisc tree (CVE-2025-38553)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: reject malicious packets in ipv6_gso_segment() (CVE-2025-38572)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: fix a race in packet_set_ring() and packet_notifier() (CVE-2025-38617)

    In the Linux kernel, the following vulnerability has been resolved:

    vsock: Do not allow binding to VMADDR_PORT_ANY (CVE-2025-38618)

    In the Linux kernel, the following vulnerability has been resolved:

    net: drop UFO packets in udp_rcv_segment() (CVE-2025-38622)

    In the Linux kernel, the following vulnerability has been resolved:

    hfsplus: remove mutex_lock check in hfsplus_free_extents (CVE-2025-38650)

    In the Linux kernel, the following vulnerability has been resolved:

    regulator: core: fix NULL dereference on unbind due to stale coupling data (CVE-2025-38668)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure (CVE-2025-38695)

    In the Linux kernel, the following vulnerability has been resolved:

    scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated (CVE-2025-38700)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr (CVE-2025-38701)

    In the Linux kernel, the following vulnerability has been resolved:

    hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (CVE-2025-38713)

    In the Linux kernel, the following vulnerability has been resolved:

    hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() (CVE-2025-38714)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724)

    In the Linux kernel, the following vulnerability has been resolved:

    ftrace: Also allocate and copy hash for reading of filter files (CVE-2025-39689)

    In the Linux kernel, the following vulnerability has been resolved:

    fs/buffer: fix use-after-free when call bh_read() helper (CVE-2025-39691)

    In the Linux kernel, the following vulnerability has been resolved:

    NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)

    In the Linux kernel, the following vulnerability has been resolved:

    net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766)

    In the Linux kernel, the following vulnerability has been resolved:

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: x86: use array_index_nospec with indices that come from guest (CVE-2025-39823)

    In the Linux kernel, the following vulnerability has been resolved:

    HID: asus: fix UAF via HID_CLAIMED_INPUT validation (CVE-2025-39824)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() The hfsplus_readdir() method is capable to crash     by calling hfsplus_uni2asc(): [ 667.121659][ T9805]     ================================================================== [ 667.122651][ T9805] BUG: KASAN: slab-     out-of-bounds in hfsplus_uni2asc+0x902/0xa10 [ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c     by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not     tainted 6.16.0-rc3 #1 PREEMPT(full) [ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX +     PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.124890][ T9805] Call Trace: [ 667.124893][     T9805] <TASK> [ 667.124896][ T9805] dump_stack_lvl+0x10e/0x1f0 [ 667.124911][ T9805]     print_report+0xd0/0x660 [ 667.124920][ T9805] ? __virt_addr_valid+0x81/0x610 [ 667.124928][ T9805] ?
    __phys_addr+0xe8/0x180 [ 667.124934][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124942][ T9805]     kasan_report+0xc6/0x100 [ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124959][ T9805]     hfsplus_uni2asc+0x902/0xa10 [ 667.124966][ T9805] ? hfsplus_bnode_read+0x14b/0x360 [ 667.124974][ T9805]     hfsplus_readdir+0x845/0xfc0 [ 667.124984][ T9805] ? __pfx_hfsplus_readdir+0x10/0x10 [ 667.124994][ T9805]     ? stack_trace_save+0x8e/0xc0 [ 667.125008][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125015][ T9805] ?     trace_lock_acquire+0x85/0xd0 [ 667.125022][ T9805] ? lock_acquire+0x30/0x80 [ 667.125029][ T9805] ?     iterate_dir+0x18b/0xb20 [ 667.125037][ T9805] ? down_read_killable+0x1ed/0x4c0 [ 667.125044][ T9805] ?     putname+0x154/0x1a0 [ 667.125051][ T9805] ? __pfx_down_read_killable+0x10/0x10 [ 667.125058][ T9805] ?     apparmor_file_permission+0x239/0x3e0 [ 667.125069][ T9805] iterate_dir+0x296/0xb20 [ 667.125076][ T9805]
    __x64_sys_getdents64+0x13c/0x2c0 [ 667.125084][ T9805] ? __pfx___x64_sys_getdents64+0x10/0x10 [     667.125091][ T9805] ? __x64_sys_openat+0x141/0x200 [ 667.125126][ T9805] ? __pfx_filldir64+0x10/0x10 [     667.125134][ T9805] ? do_user_addr_fault+0x7fe/0x12f0 [ 667.125143][ T9805] do_syscall_64+0xc9/0x480 [     667.125151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.125158][ T9805] RIP:
    0033:0x7fa8753b2fc9 [ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89     f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS:
    00000217 ORIG_RAX: 00000000000000d9 [ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX:
    00007fa8753b2fc9 [ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004 [     667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110 [ 667.125195][     T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13:
    0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.125207][ T9805] </TASK> [ 667.125210][     T9805] [ 667.145632][ T9805] Allocated by task 9805: [ 667.145991][ T9805] kasan_save_stack+0x20/0x40 [     667.146352][ T9805] kasan_save_track+0x14/0x30 [ 667.146717][ T9805] __kasan_kmalloc+0xaa/0xb0 [     667.147065][ T9805] __kmalloc_noprof+0x205/0x550 [ 667.147448][ T9805] hfsplus_find_init+0x95/0x1f0 [     667.147813][ T9805] hfsplus_readdir+0x220/0xfc0 [ 667.148174][ T9805] iterate_dir+0x296/0xb20 [     667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.148937][ T9805] do_syscall_64+0xc9/0x480 [     667.149291][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.149809][ T9805] [ 667.150030][ T9805]     The buggy address belongs to the object at ffff88802592f000 [ 667.150030][ T9805] which belongs to the     cache kmalloc-2k of size 2048 [ 667.151282][ T9805] The buggy address is located 0 bytes to the right of [     667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c) [ 667.1
    ---truncated--- (CVE-2025-38713)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
266180	Amazon Linux 2 : kernel, --advisory ALAS2-2025-3013 (ALAS-2025-3013)	Nessus	Amazon Linux Local Security Checks	high
265709	Debian dsa-6009 : affs-modules-6.1.0-37-4kc-malta-di - security update	Nessus	Debian Local Security Checks	medium
265433	Photon OS 4.0: Linux PHSA-2025-4.0-0864	Nessus	PhotonOS Local Security Checks	high
265084	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2025-104 (ALASKERNEL-5.10-2025-104)	Nessus	Amazon Linux Local Security Checks	medium
265070	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2025-109 (ALASKERNEL-5.4-2025-109)	Nessus	Amazon Linux Local Security Checks	high
261559	Linux Distros Unpatched Vulnerability : CVE-2025-38713	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-38713

medium

Tenable Plugins

high

medium

high

medium

high

medium