Executive brief
A vulnerability in the Linux kernel's Ceph file system client could allow users to bypass security restrictions. In environments where multiple Ceph file systems are used, the system fails to properly distinguish between different sets of user permissions. This means a user granted only 'read' access to one file system might incorrectly inherit 'write' or 'delete' permissions from another file system they have access to, potentially leading to unauthorized data modification or loss.
Technical details
A flaw was discovered in the Linux kernel's Ceph file system implementation (fs/ceph) where the Metadata Server (MDS) authentication capability check fails to validate the 'fsname' associated with the capabilities. In a multi-FS Ceph cluster, this root cause allows the authentication capabilities of one file system to be incorrectly applied to another. An attacker with local access and valid credentials for at least one file system in a multi-FS cluster can exploit this to gain unauthorized read/write/delete privileges on other file systems where they should have restricted access. The fix involves updating ceph_mds_auth_match to validate the mds_namespace and ensuring mdsmap decoding validates the fsname against mount options. Patches are available in stable kernel releases 6.12.58 and 6.17.8.
Affected products
- Linux Linux Kernel 6.10 to 6.12.57, 6.17.7
Timeline
- 2025-12-16: advisory: CVE-2025-40362 published by NVD
- 2025-11-13: patched: Fix committed to stable kernel tree