Bug 2467185 (CVE-2025-71271)

Summary:	CVE-2025-71271 kernel: hfsplus: ensure sb->s_fs_info is always cleaned up
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the hfsplus filesystem driver in the Linux kernel. A bug was introduced during the conversion of hfsplus to the new mount API, leading to a memory leak. If the `setup_bdev_super()` function fails after a new superblock is allocated but before `hfsplus_fill_super()` takes ownership of the filesystem-specific data, the `sb->s_fs_info` memory is not properly cleaned up. This can result in system resource exhaustion.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-06 13:09:23 UTC

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: ensure sb->s_fs_info is always cleaned up

When hfsplus was converted to the new mount api a bug was introduced by
changing the allocation pattern of sb->s_fs_info. If setup_bdev_super()
fails after a new superblock has been allocated by sget_fc(), but before
hfsplus_fill_super() takes ownership of the filesystem-specific s_fs_info
data it was leaked.

Fix this by freeing sb->s_fs_info in hfsplus_kill_super().

Comment 1 Keith Grant 2026-05-06 16:34:38 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026050614-CVE-2025-71271-6cab@gregkh/T