CVE-2025-38715: linux kernel +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2025-38715

CVSS 7.1 · High EPSS 0,17%

Kerentanan Out-of-bounds Read pada linux kernel, debian linux. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: hfs: fix slab-out-of-bounds in hfs_bnode_read() This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfs_bnode_read(), hfs_bnode_write(), hfs_bnode_clear(), hfs_bnode_copy(), and hfs_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash.

Rincian

Terbit di NVD: 4 September 2025
Terakhir diubah: 30 Juli 2026
Status NVD: Modified
CVSS 3.1: 7.1 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-125: Out-of-bounds Read
EPSS (30 hari): 0,17% peluang dieksploitasi; lebih tinggi dari 6,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
linux	linux kernel	Versi 2.6.12.1 hingga sebelum 5.4.297
linux	linux kernel	Versi 5.5 hingga sebelum 5.10.241
linux	linux kernel	Versi 5.11 hingga sebelum 5.15.190
linux	linux kernel	Versi 5.16 hingga sebelum 6.1.149
linux	linux kernel	Versi 6.2 hingga sebelum 6.6.103
linux	linux kernel	Versi 6.7 hingga sebelum 6.12.43
linux	linux kernel	Versi 6.13 hingga sebelum 6.15.11
linux	linux kernel	Versi 6.16 hingga sebelum 6.16.2
linux	linux kernel	Versi 2.6.12
linux	linux kernel	Versi 2.6.12 rc2
linux	linux kernel	Versi 2.6.12 rc3
linux	linux kernel	Versi 2.6.12 rc4
linux	linux kernel	Versi 2.6.12 rc5
debian	debian linux	Versi 11.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://git.kernel.org/stable/c/384a66b89f9540a9a8cb0f48807697dfabaece4c patch
https://git.kernel.org/stable/c/67ecc81f6492275c9c54280532f558483c99c90e patch
https://git.kernel.org/stable/c/a1a60e79502279f996e55052f50cc14919020475 patch
https://git.kernel.org/stable/c/a431930c9bac518bf99d6b1da526a7f37ddee8d8 patch
https://git.kernel.org/stable/c/e7d2dc2421e821e4045775e6dc226378328de6f6 patch
https://git.kernel.org/stable/c/eec522fd0d28106b14a59ab2d658605febe4a3bb patch
https://git.kernel.org/stable/c/efc095b35b23297e419c2ab4fc1ed1a8f0781a29 patch
https://git.kernel.org/stable/c/fc7f732984ec91f30be3e574e0644066d07f2b78 patch
https://git.kernel.org/stable/c/fe2891a9c43ab87d1a210d61e6438ca6936e2f62 patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html mailing list · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html mailing list · advisory pihak ketiga
https://cert-portal.siemens.com/productcert/html/ssa-032379.html

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.