CVE-2025-71271

MediumCVSS 5.5/10Last modified Oct 14, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

hfsplus: ensure sb->s_fs_info is always cleaned up

When hfsplus was converted to the new mount api a bug was introduced by changing the allocation pattern of sb->s_fs_info. If setup_bdev_super() fails after a new superblock has been allocated by sget_fc(), but before hfsplus_fill_super() takes ownership of the filesystem-specific s_fs_info data it was leaked.

Fix this by freeing sb->s_fs_info in hfsplus_kill_super().

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

No affected versions have been published.

Timeline

Published
May 6, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-712725.5In the Linux kernel, the following vulnerability has been resolved: most: core: fix resource leak in most_register_interface error paths TCVE-2025-712735.5In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() Simplify tCVE-2025-712744.7In the Linux kernel, the following vulnerability has been resolved: rpmsg: core: fix race in driver_override_show() and use core helper ThCVE-2025-712766.1SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.CVE-2025-712788.8XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on anyCVE-2025-712799.8XenForo before 2.3.7 contains a security issue affecting Passkeys that have been added to user accounts. An attacker may be able to compromiCVE-2025-71289.8A vulnerability has been found in Campcodes Payroll Management System 1.0 and classified as critical. This vulnerability affects unknown codCVE-2025-712805.5XenForo before 2.3.7 allows information disclosure via local account page caching on shared systems. On systems where multiple users share aCVE-2025-712819.8XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter CVE-2025-712827.5XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker tCVE-2025-712849.8Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.CVE-2025-712855.5In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels MHI st