CVE-2025-68767

hfsplus: Verify inode mode when loading from disk

7.1 HighFix available

What does this mean?

: 7.1v4.0, from OSV
: 0.21%10th percentile
Fixed in: 6.6.121.1-1kernel
Published: January 13, 2026
Modified: November 10, 2026
Also known as: AZL-74315BELL-CVE-2025-68767CLSA-2026-1789958474CLSA-2026-1792980237DEBIAN-CVE-2025-68767DLA-4475-1DLA-4476-1DSA-6126-1
Show 39 moreShow less
DSA-6127-1EUVD-2026-2317GHSA-mgmc-76vj-qf3jMGASA-2026-0017MGASA-2026-0018ROOT-OS-DEBIAN-11-CVE-2025-68767ROOT-OS-DEBIAN-12-CVE-2025-68767ROOT-OS-UBUNTU-2204-CVE-2025-68767ROOT-OS-UBUNTU-2404-CVE-2025-68767SUSE-SU-2026:0473-1UBUNTU-CVE-2025-68767USN-8096-1USN-8096-2USN-8096-3USN-8096-4USN-8096-5USN-8116-1USN-8141-1USN-8163-1USN-8163-2USN-8177-1USN-8177-2USN-8179-1USN-8179-2USN-8179-3USN-8179-4USN-8183-1USN-8183-2USN-8184-1USN-8185-1USN-8185-2USN-8203-1USN-8204-1USN-8243-1USN-8245-1USN-8258-1USN-8261-1USN-8265-1USN-8440-1

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: Verify inode mode when loading from disk

syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 16bits "mode" field loaded from disk are corrupted.

According to [1], the permissions field was treated as reserved in Mac OS 8 and 9. According to [2], the reserved field was explicitly initialized with 0, and that field must remain 0 as long as reserved. Therefore, when the "mode" field is not 0 (i.e. no longer reserved), the file must be S_IFDIR if dir == 1, and the file must be one of S_IFREG/S_IFLNK/S_IFCHR/ S_IFBLK/S_IFIFO/S_IFSOCK if dir == 0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.21%Up 0.2 points since Jan 14, 2026

What each source reports

OSV Score usedUBUNTU-CVE-2025-68767 7.1

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Verify inode mode when loading from disk syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 16bits "mode" field loaded from disk are corrupted. According to [1], the permissions field was treated as reserved in Mac OS 8 and 9. According to [2], the reserved field was explicitly initialized with 0, and that field must remain 0 as long as reserved. Therefore, when the "mode" field is not 0 (i.e. no longer reserved), the file must be S_IFDIR if dir == 1, and the file must be one of S_IFREG/S_IFLNK/S_IFCHR/ S_IFBLK/S_IFIFO/S_IFSOCK if dir == 0.

Record: UBUNTU-CVE-2025-68767
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-10

CVE List No score

hfsplus: Verify inode mode when loading from disk

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: Verify inode mode when loading from disk

syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 16bits "mode" field loaded from disk are corrupted.

Record: CVE-2025-68767
Updated: 2026-11-02

EUVDEUVD-2026-2317 No score

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: Verify inode mode when loading from disk

syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 16bits "mode" field loaded from disk are corrupted.

Record: EUVD-2026-2317
Updated: 2026-11-02

GitHub AdvisoriesGHSA-mgmc-76vj-qf3j No score

In the Linux kernel, the following vulnerability has been resolved: hfsplus: Verify inode mode...

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: Verify inode mode when loading from disk

syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 16bits "mode" field loaded from disk are corrupted.

Record: GHSA-mgmc-76vj-qf3j
Updated: 2026-11-02

NVD No score

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: Verify inode mode when loading from disk

syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 16bits "mode" field loaded from disk are corrupted.

Record: CVE-2025-68767
Updated: 2026-11-02

OSVAZL-74315 No score

CVE-2025-68767 affecting package kernel for versions less than 6.6.121.1-1

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: Verify inode mode when loading from disk

syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 16bits "mode" field loaded from disk are corrupted.

Record: AZL-74315
Updated: 2026-11-02

Show 39 moreShow less

OSVCLSA-2026-1789958474 No score

Fix of 167 CVEs

CVE-2025-39826
- net: rose: convert 'use' field to refcount_t {CVE-2025-39826}
CVE-2025-40146
- blk-mq: fix potential deadlock while nr_requests grown {CVE-2025-40146}
CVE-2024-53216
- nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}
CVE-2026-89778
- isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
CVE-2026-23050
- pNFS: Fix a deadlock when returning a delegation during open() {CVE-2026-23050}
CVE-2025-68796
- f2fs: fix to avoid updating zero-sized extent in extent cache {CVE-2025-68796}
CVE-2025-68330
- iio: accel: bmc150: Fix irq assumption regression {CVE-2025-68330}
CVE-2025-40333
- f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333}
CVE-2025-40160
- xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160}
CVE-2023-54047
- drm/rockchip: dw_hdmi: cleanup drm encoder during unbind {CVE-2023-54047}
CVE-2025-68190
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190}
CVE-2025-68188
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188}
CVE-2026-89786
- ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
CVE-2022-50764
- ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764}
CVE-2026-80785
- fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785}
CVE-2026-80788
- nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations {CVE-2026-80788}
CVE-2026-80747
- drm/amdkfd: Add bounds check for CRAT subtype length {CVE-2026-80747}
CVE-2026-80907
- drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907}
CVE-2026-80908
- drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908}
CVE-2026-80812
- ALSA: dummy: Check card index validity at probe {CVE-2026-80812}
CVE-2026-80948
- wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948}
CVE-2025-40137
- f2fs: fix to truncate first page in error path of f2fs_truncate() {CVE-2025-40137}
CVE-2023-54150
- drm/amd: Fix an out of bounds error in BIOS parser {CVE-2023-54150}
CVE-2026-89784
- SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784}
CVE-2026-89783
- xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783}
CVE-2026-89780
- net: qualcomm: rmnet: restore skb->dev on deaggregated frames {CVE-2026-89780}
CVE-2026-89777
- vfio/pci: clear vdev->msi_perm after freeing it on init failure {CVE-2026-89777}
CVE-2026-89789
- gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free {CVE-2026-89789}
CVE-2025-68797
- char: applicom: fix NULL pointer dereference in ac_ioctl {CVE-2025-68797}
CVE-2025-68767
- hfsplus: Verify inode mode when loading from disk {CVE-2025-68767}
CVE-2026-63961
- usb: typec: altmodes/displayport: validate count before reading Status Update VDO {CVE-2026-63961}
CVE-2026-63904
- usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904}
CVE-2022-50864
- nilfs2: fix shift-out-of-bounds due to too large exponent of block size {CVE-2022-50864}
CVE-2025-68771
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain {CVE-2025-68771}
CVE-2025-68750
- usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750}
CVE-2026-80909
- drm/amdgpu: Reject UVD message with invalid number of h265 refs {CVE-2026-80909}
CVE-2026-74402
- crypto: atmel-sha204a - fix blocking and non-blocking rng logic {CVE-2026-74402} *…

Record: CLSA-2026-1789958474
Updated: 2026-11-02

OSVCLSA-2026-1792980237 No score

Fix of 276 CVEs

CVE-2022-49416
- wifi: mac80211: fix use-after-free in chanctx code {CVE-2022-49416}
CVE-2022-49685
- iio: trigger: sysfs: fix use-after-free on remove {CVE-2022-49685}
CVE-2021-47670
- can: peak_usb: fix use after free bugs {CVE-2021-47670}
CVE-2026-98706
- wifi: mac80211: drain PS delivery work during station teardown {CVE-2026-98706}
CVE-2026-98610
- net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget {CVE-2026-98610}
CVE-2026-98548
- sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548}
CVE-2026-98614
- sctp: avoid livelock while updating retransmit path {CVE-2026-98614}
CVE-2026-98547
- af_packet: fix integer overflow in prb_calc_retire_blk_tmo() {CVE-2026-98547}
CVE-2026-98579
- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure {CVE-2026-98579}
CVE-2026-98581
- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() {CVE-2026-98581}
CVE-2026-98577
- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() {CVE-2026-98577}
CVE-2026-98482
- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() {CVE-2026-98482}
CVE-2026-98576
- nfc: llcp: fix slab-out-of-bounds reads when logging service names {CVE-2026-98576}
CVE-2026-98624
- netfilter: nfnetlink_queue: hold nfnl mutex in event notifier {CVE-2026-98624}
- netlink: use blocking notifier {CVE-2026-98624}
CVE-2026-98794
- ipvs: filter some flags received in the backup server {CVE-2026-98794}
CVE-2026-98829
- wifi: mac80211: drop oversized fragments to avoid extra_len overflow {CVE-2026-98829}
CVE-2026-98708
- wifi: mac80211: keep paired old chanctx alive {CVE-2026-98708}
CVE-2026-98707
- wifi: mac80211: shut down RX BA session timer on teardown {CVE-2026-98707}
CVE-2026-98532
- ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532}
CVE-2026-98541
- fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT {CVE-2026-98541}
CVE-2026-98461
- Bluetooth: hci_sock: validate event length before filtering {CVE-2026-98461}
CVE-2026-98621
- net: gue: reject invalid REMCSUM offsets {CVE-2026-98621}
CVE-2026-98526
- llc: reserve device headroom for allocated frames {CVE-2026-98526}
CVE-2026-98555
- llc: fix skb UAF and leaks on llc_mac_hdr_init() failure {CVE-2026-98555}
CVE-2026-98573
- net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573}
CVE-2026-98739
- Bluetooth: RFCOMM: Fix initial port reference race {CVE-2026-98739}
CVE-2026-98457
- Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457}
CVE-2026-98460
- Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460}
CVE-2026-98856
- kprobes: Skip disarmed probes when checking optkprobe overlap {CVE-2026-98856}
CVE-2026-98636
- squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636}
CVE-2026-98681
- smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races {CVE-2026-98681}
CVE-2026-98771
- usb: storage: sierra_ms: reject short SWoC info transfers {CVE-2026-98771}
CVE-2026-98772
- USB: serial: fix port tear down use-after-free {CVE-2026-98772}
CVE-2026-98696
- USB: serial: fix driver deregistration order {CVE-2026-98696}
CVE-2026-98697
- USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697}
CVE-2026-98769
- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769}
CVE-2026-98764
- usb: gadget: f_fs: Fix NULL pointer dereference in …

Record: CLSA-2026-1792980237
Updated: 2026-11-02

OSV No score

hfsplus: Verify inode mode when loading from disk

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: Verify inode mode when loading from disk

syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 16bits "mode" field loaded from disk are corrupted.

Record: CVE-2025-68767
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-68767 No score

Record: DEBIAN-CVE-2025-68767
Updated: 2026-11-02

OSVMGASA-2026-0017 No score

Updated kernel, kmod-virtualbox & kmod-xtables-addons packages fix security vulnerabilities

Upstream kernel version 6.6.120 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel.

Record: MGASA-2026-0017
Updated: 2026-11-02

OSVMGASA-2026-0018 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.6.120 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2026-0018
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-11-CVE-2025-68767 No score

CVE-2025-68767 in linux - Patched by Root

Root has patched CVE-2025-68767 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2025-68767
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2025-68767 No score

CVE-2025-68767 in linux - Patched by Root

Root has patched CVE-2025-68767 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2025-68767
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2025-68767 No score

CVE-2025-68767 in linux - Patched by Root

Root has patched CVE-2025-68767 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2025-68767
Updated: 2026-11-06

OSVROOT-OS-UBUNTU-2404-CVE-2025-68767 No score

CVE-2025-68767 in linux - Patched by Root

Root has patched CVE-2025-68767 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2025-68767
Updated: 2026-11-06

OSVSUSE-SU-2026:0473-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50347: mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() (bsc#1249928).
CVE-2022-50580: blk-throttle: prevent overflow while calculating wait time (bsc#1252542).
CVE-2022-50676: net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() (bsc#1254689).
CVE-2022-50697: mrp: introduce active flags to prevent UAF when applicant uninit (bsc#1255594).
CVE-2022-50709: wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() (bsc#1255565).
CVE-2022-50716: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out (bsc#1255839).
CVE-2022-50717: nvmet-tcp: add bounds check on Transfer Tag (bsc#1255844).
CVE-2022-50719: ALSA: line6: fix stack overflow in line6_midi_transmit (bsc#1255939).
CVE-2022-50740: wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() (bsc#1256155).
CVE-2022-50744: scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs (bsc#1256165).
CVE-2022-50749: acct: fix potential integer overflow in encode_comp_t() (bsc#1256191).
CVE-2022-50751: configfs: fix possible memory leak in configfs_create_dir() (bsc#1256184).
CVE-2022-50760: drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() (bsc#1255983).
CVE-2022-50770: ocfs2: fix memory leak in ocfs2_mount_volume() (bsc#1256221).
CVE-2022-50777: net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe (bsc#1256320).
CVE-2022-50780: net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed (bsc#1256305).
CVE-2022-50782: ext4: fix bug_on in __es_tree_search caused by bad quota inode (bsc#1256282).
CVE-2022-50786: media: s5p-mfc: Clear workbit to handle error condition (bsc#1256258).
CVE-2022-50816: ipv6: ensure sane device mtu in tunnels (bsc#1256038).
CVE-2022-50834: nfc: Fix potential resource leaks (bsc#1256219).
CVE-2022-50865: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (bsc#1256168).
CVE-2022-50868: hwrng: amd - Fix PCI device refcount leak (bsc#1256386).
CVE-2022-50880: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() (bsc#1256132).
CVE-2022-50881: ath9k: Fix typo in function name (bsc#1256130).
CVE-2022-50884: drm: Prevent drm_copy_field() to attempt copying a NULL pointer (bsc#1256127).
CVE-2022-50885: RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed (bsc#1256122).
CVE-2022-50887: regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() (bsc#1256125).
CVE-2023-50756: nvme-pci: fix mempool alloc size (bsc#1256216).
CVE-2023-53685: tun: Fix memory leak for detached NAPI queue (bsc#1251770).
CVE-2023-53747: vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (bsc#1254572).
CVE-2023-53751: cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (bsc#1254986).
CVE-2023-53825: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg() (bsc#1254707).
CVE-2023-53853: netlink: annotate accesses to nlk->cb_running (bsc#1254673).
CVE-2023-53863: netlink: do not hard code device address lenth in fdb dumps (bsc#1254657).
CVE-2023-53992: wifi: cfg80211: ocb: don't leave if not joined (bsc#1256058).
CVE-2023-54012: net: fix stack overflow when LRO is disabled for virtual interfaces (bsc#1255571).
CVE-2023-54047: drm/rockchip: dw_hdmi: cleanup drm encoder during unbind (bsc#1256398).
CVE-2023-54048: RDMA/bnxt_re: Prevent handling any completions after qp destroy (bsc#1256395).
CVE-2023-54067: btrfs: fix race when deleting free space root from the dirty cow roots list (bsc#1256369).
CVE-2023-54111: pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups (bsc#1256149).
CVE-2023-54112: kcm: Fix memory leak in error path of kcm_sendmsg() (bsc#1256354).
CVE-2023-54118: serial: sc16is7xx: setup GPIO controller later in probe…

Record: SUSE-SU-2026:0473-1
Updated: 2026-11-02

OSVUSN-8096-1 No score

linux, linux-aws, linux-gcp, linux-gkeop, linux-ibm, linux-ibm-5.15, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-oracle, linux-xilinx-zynqmp vulnerabilities