Executive brief
A vulnerability was identified in the Linux kernel's Ceph network messenger component, which handles communication for Ceph distributed storage. Due to a coding error, the system may incorrectly access memory when using newer versions of the communication protocol, potentially leading to data corruption or system instability. This could impact the reliability and security of storage operations in environments using Ceph.
Technical details
A vulnerability exists in the libceph module of the Linux kernel due to invalid accesses to the ceph_connection_v1_info union member. In messenger.c, the code reads from and writes to the 'v1' union member without verifying if the msgr1 protocol is actually in use. On 64-bit systems, these v1 fields overlap with v2 fields (specifically v1.auth_retry overlaps with v2.out_iter, and v1.connect_seq overlaps with v2.conn_bufs). When the msgr2 protocol is active, these incorrect accesses can lead to bogus value reads or memory corruption via invalid writes. This can result in unauthorized authorizer invalidation or more severe consequences depending on the state of the connection buffers. Patches have been released for various stable kernel branches including 5.15.y, 6.1.y, 6.6.y, and 6.12.y.
Affected products
- Linux Linux Kernel 5.11 to 5.15.194, 6.1.153, 6.6.107, 6.12.48, 6.16.8
Timeline
- 2025-07-03: patched: Initial fix authored by Ilya Dryomov
- 2025-09-23: disclosed: CVE published
References
- https://git.kernel.org/stable/c/23538cfbeed87159a5ac6c61e7a6de3d8d4486a8
- https://git.kernel.org/stable/c/35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983
- https://git.kernel.org/stable/c/591ea9c30737663a471b2bb07b27ddde86b020d5
- https://git.kernel.org/stable/c/6bd8b56899be0b514945f639a89ccafb8f8dfaef
- https://git.kernel.org/stable/c/cdbc9836c7afadad68f374791738f118263c5371
- https://git.kernel.org/stable/c/ea12ab684f8ae8a6da11a22c78d94a79e2163096
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html