Executive brief
A vulnerability was identified in the Linux kernel's Ceph file system component, which is used for distributed data storage. The flaw involves how the system handles long, encrypted snapshot names, potentially allowing an attacker to cause a system crash or gain unauthorized access to data. This could impact the reliability of storage services and the confidentiality of stored information. Patches have been released to address this issue by ensuring data is handled safely during processing.
Technical details
A vulnerability exists in the Linux kernel's Ceph file system driver within the `parse_longname()` function in `fs/ceph/crypto.c`. The function uses `strrchr()` on a string that is not guaranteed to be NUL-terminated, which can lead to out-of-bounds memory access. While the code previously used `kmemdup_nul()` for specific sub-strings, it failed to ensure the primary buffer passed to string processing functions was safely terminated. An attacker could potentially exploit this to cause a kernel oops (denial of service) or achieve arbitrary code execution, depending on memory layout. The fix involves ensuring the entire input string is NUL-terminated before processing. Patches are available in stable kernel releases 6.12.42, 6.15.10, and 6.16.1.
Affected products
- Linux Linux Kernel 6.6 to 6.12.42, 6.13 to 6.15.10, 6.16 to 6.16.1
Timeline
- 2025-08-22: disclosed
- 2025-08-22: advisory