A high-severity memory handling flaw in the Linux kernel hpfs file system allows local authenticated users to cause a denial of service and potential system compromise.

This is an improper handling of uninitialized resources in the hpfs file system component, triggered when the hpfs_map_dnode_bitmap function fails, requiring low local privileges and no user interaction.

A successful exploit of this vulnerability can result in kernel panics leading to unexpected system reboots, system downtime, and potential service disruption. Given the high CVSS score of 7.8, organizations running vulnerable kernel versions face significant risks to operational availability, particularly on shared hosting or multi-tenant systems where local users have untrusted access.

Immediate Action: Update the Linux kernel to version 5.10.259, 5.15.210, 6.1.176, 6.6.143, or later depending on the active release branch.

Proactive Monitoring: Monitor system logs for kernel panic events, unexpected reboots, and storage driver errors associated with the hpfs file system.

Compensating Controls: Restrict local system access to trusted users only and disable the hpfs kernel module if the High Performance File System is not required by local workloads.

Public Exploit Available: false

Administrators managing systems utilizing the hpfs file system should prioritize updating their kernel packages to the patched versions as soon as they become available from their distribution vendors. Applying these updates eliminates the crash vector and restores stability to the storage subsystem.