{"cve":"CVE-2025-68767","nvd":{"published":"2026-01-13T16:15:56.120","modified":"2026-06-17T09:59:33.223","status":"Deferred","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nhfsplus: Verify inode mode when loading from disk\n\nsyzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when\nthe S_IFMT bits of the 16bits \"mode\" field loaded from disk are corrupted.\n\nAccording to [1], the permissions field was treated as reserved in Mac OS\n8 and 9. According to [2], the reserved field was explicitly initialized\nwith 0, and that field must remain 0 as long as reserved. Therefore, when\nthe \"mode\" field is not 0 (i.e. no longer reserved), the file must be\nS_IFDIR if dir == 1, and the file must be one of S_IFREG/S_IFLNK/S_IFCHR/\nS_IFBLK/S_IFIFO/S_IFSOCK if dir == 0.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/001f44982587ad462b3002ee40c75e8df67d597d","https://git.kernel.org/stable/c/005d4b0d33f6b4a23d382b7930f7a96b95b01f39","https://git.kernel.org/stable/c/05ec9af3cc430683c97f76027e1c55ac6fd25c59","https://git.kernel.org/stable/c/6f768724aabd5b321c5b8f15acdca11e4781cf32","https://git.kernel.org/stable/c/91f114bffa36ce56d0e1f60a0a44fc09baaefc79"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:19:41.481987139+00:00"},"epss":{"cve":"CVE-2025-68767","score":0.00207,"percentile":0.10869,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}