CVE-2025-39880libceph: fix invalid accesses to ceph_connection_v1_info
Updated under an hour ago ()
Does this affect you?
It affects Linux and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: libceph: fix invalid accesses to ceph_connection_v1_info There is a place where generic code in messenger.c is reading and another place where it is writing to con->v1 union member without checking that the union member is active (i.e. msgr1 is in use). On 64-bit systems, con->v1.auth_retry overlaps with con->v2.out_iter, so such a read is almost guaranteed to return a bogus value instead of 0 when msgr2 is in use. This ends up being fairly benign because the side effect is just the invalidation of the authorizer and successive fetching of new tickets. con->v1.connect_seq overlaps with con->v2.conn_bufs and the fact that it's being written to can cause more serious consequences, but luckily it's not something that happens often.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from cd1a677cad994021b19665ed476aea63f5d54f31 before ea12ab684f8ae8a6da11a22c78d94a79e2163096; from cd1a677cad994021b19665ed476aea63f5d54f31 before 591ea9c30737663a471b2bb07b27ddde86b020d5; from cd1a677cad994021b19665ed476aea63f5d54f31 before 23538cfbeed87159a5ac6c61e7a6de3d8d4486a8; from cd1a677cad994021b19665ed476aea63f5d54f31 before 35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983; from cd1a677cad994021b19665ed476aea63f5d54f31 before 6bd8b56899be0b514945f639a89ccafb8f8dfaef; from cd1a677cad994021b19665ed476aea63f5d54f31 before cdbc9836c7afadad68f374791738f118263c5371 | CNA record |
linux linux_kernel linux:linux_kernel | from 5.11 before 5.15.194; from 5.16 before 6.1.153; from 6.2 before 6.6.107; from 6.7 before 6.12.48; from 6.13 before 6.16.8; 6.17; 6.17; 6.17; and 2 more ranges | NVD |
debian debian_linux debian:debian_linux | 11.0 | NVD |
References
- https://git.kernel.org/stable/c/ea12ab684f8ae8a6da11a22c78d94a79e2163096patch
- https://git.kernel.org/stable/c/591ea9c30737663a471b2bb07b27ddde86b020d5patch
- https://git.kernel.org/stable/c/23538cfbeed87159a5ac6c61e7a6de3d8d4486a8patch
- https://git.kernel.org/stable/c/35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983patch
- https://git.kernel.org/stable/c/6bd8b56899be0b514945f639a89ccafb8f8dfaefpatch
- https://git.kernel.org/stable/c/cdbc9836c7afadad68f374791738f118263c5371patch
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlmailing-list, third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.