Memory Initialization Flaw in HFS Implementation of Linux Kernel by The Linux Foundation

CVE-2025-40243

What is CVE-2025-40243?

A memory initialization flaw exists in the HFS (Hierarchical File System) implementation of the Linux kernel. Specifically, within the hfs_find_set_zero_bits() function, uninitialized memory can lead to erroneous bitmap operations, affecting file system stability. This flaw can cause potential volume corruptions when 'garbage' data is present in the allocated buffer during bitmap management operations. To address this, a patch has been introduced to replace the use of kmalloc() with kzalloc(), ensuring that newly allocated buffers are properly initialized to zero, thereby preventing inconsistencies and enhancing overall file system reliability.

References