{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-39880", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.144Z", "datePublished": "2025-09-23T06:00:49.897Z", "dateUpdated": "2026-08-05T12:05:50.970Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:50.970Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix invalid accesses to ceph_connection_v1_info\n\nThere is a place where generic code in messenger.c is reading and\nanother place where it is writing to con->v1 union member without\nchecking that the union member is active (i.e. msgr1 is in use).\n\nOn 64-bit systems, con->v1.auth_retry overlaps with con->v2.out_iter,\nso such a read is almost guaranteed to return a bogus value instead of\n0 when msgr2 is in use. This ends up being fairly benign because the\nside effect is just the invalidation of the authorizer and successive\nfetching of new tickets.\n\ncon->v1.connect_seq overlaps with con->v2.conn_bufs and the fact that\nit's being written to can cause more serious consequences, but luckily\nit's not something that happens often." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The faulting/STANDBY transitions that reach both bad accesses are driven by the remote ceph peer's socket behaviour (connection reset, close, or a failed msgr2 handshake) over TCP, so a malicious or compromised MON/OSD/MDS — or an on-path attacker able to disrupt the session — triggers the code remotely. This matches how other libceph peer-data bugs (CVE-2026-22984, CVE-2026-22990) are scored.\nAC:L - No race or unusual precondition is needed: on any msgr2 connection the union misread is essentially deterministic (`v1.auth_retry` aliases a non-NULL pointer's low word), and the `connect_seq++` write happens on every fault-to-STANDBY followed by a queued message or keepalive, both of which the attacker can induce repeatedly by resetting the connection. msgr2 is the standard deployment mode for modern Ceph clusters, not a rare configuration.\nPR:N - The attacker needs no account or privilege on the victim host; it acts as the remote ceph peer or as a network attacker on the connection. The fault path is reachable during the msgr2 handshake before authentication completes, so it is a pre-authentication trigger.\nUI:N - Everything happens inside the libceph connection state machine and its workqueue handler on an already-established CephFS mount or mapped RBD device; no victim action is required at exploit time.\nS:U - The corruption is confined to kernel memory within the same security authority as the vulnerable code; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The confused `v1.auth_retry` read exposes the low 32 bits of a kernel heap pointer (into the connection object) to a branch decision and to the `dout()` log, and the corrupted `conn_bufs[]` pointer can direct handshake buffers — some of which, such as `authorizer_copy`, are copied out and sent to the peer — at unintended kernel memory, yielding attacker-visible disclosure.\nI:H - This is a union type confusion that performs out-of-bounds writes relative to the active member: zeroing half of `v2.out_iter`'s iovec pointer and incrementing half of a `v2.conn_bufs[]` pointer, corrupting kernel pointer state. The maintainer explicitly notes the `connect_seq` write \"can cause more serious consequences,\" and the affected slot varies across the six affected stable branches because of differing struct layouts.\nA:H - A mangled `conn_bufs[]` entry is consumed by `kvfree()` in `free_conn_bufs()` and dereferenced as a handshake buffer, so the corruption can produce an invalid free or wild access resulting in an oops/panic, taking down a storage client node; the attacker can retrigger the condition indefinitely by repeatedly faulting the connection." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ceph/messenger.c" ], "versions": [ { "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "ea12ab684f8ae8a6da11a22c78d94a79e2163096", "status": "affected", "versionType": "git" }, { "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "591ea9c30737663a471b2bb07b27ddde86b020d5", "status": "affected", "versionType": "git" }, { "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "23538cfbeed87159a5ac6c61e7a6de3d8d4486a8", "status": "affected", "versionType": "git" }, { "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983", "status": "affected", "versionType": "git" }, { "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "6bd8b56899be0b514945f639a89ccafb8f8dfaef", "status": "affected", "versionType": "git" }, { "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "cdbc9836c7afadad68f374791738f118263c5371", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ceph/messenger.c" ], "versions": [ { "version": "5.11", "status": "affected" }, { "version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.194", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.153", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.107", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.48", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.8", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.194" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.153" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.107" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.48" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.16.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ea12ab684f8ae8a6da11a22c78d94a79e2163096" }, { "url": "https://git.kernel.org/stable/c/591ea9c30737663a471b2bb07b27ddde86b020d5" }, { "url": "https://git.kernel.org/stable/c/23538cfbeed87159a5ac6c61e7a6de3d8d4486a8" }, { "url": "https://git.kernel.org/stable/c/35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983" }, { "url": "https://git.kernel.org/stable/c/6bd8b56899be0b514945f639a89ccafb8f8dfaef" }, { "url": "https://git.kernel.org/stable/c/cdbc9836c7afadad68f374791738f118263c5371" } ], "title": "libceph: fix invalid accesses to ceph_connection_v1_info", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:44:22.996Z" } } ] } }