{"id":"CVE-2025-39880","state":"PUBLISHED","title":"libceph: fix invalid accesses to ceph_connection_v1_info","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix invalid accesses to ceph_connection_v1_info\n\nThere is a place where generic code in messenger.c is reading and\nanother place where it is writing to con->v1 union member without\nchecking that the union member is active (i.e. msgr1 is in use).\n\nOn 64-bit systems, con->v1.auth_retry overlaps with con->v2.out_iter,\nso such a read is almost guaranteed to return a bogus value instead of\n0 when msgr2 is in use.  This ends up being fairly benign because the\nside effect is just the invalidation of the authorizer and successive\nfetching of new tickets.\n\ncon->v1.connect_seq overlaps with con->v2.conn_bufs and the fact that\nit's being written to can cause more serious consequences, but luckily\nit's not something that happens often.","publishedAt":"2025-09-23T06:00:49.897Z","updatedAt":"2026-10-15T22:02:32.742Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"cd1a677cad994021b19665ed476aea63f5d54f31","status":"affected","lessThan":"ea12ab684f8ae8a6da11a22c78d94a79e2163096","versionType":"git"},{"version":"cd1a677cad994021b19665ed476aea63f5d54f31","status":"affected","lessThan":"591ea9c30737663a471b2bb07b27ddde86b020d5","versionType":"git"},{"version":"cd1a677cad994021b19665ed476aea63f5d54f31","status":"affected","lessThan":"23538cfbeed87159a5ac6c61e7a6de3d8d4486a8","versionType":"git"},{"version":"cd1a677cad994021b19665ed476aea63f5d54f31","status":"affected","lessThan":"35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983","versionType":"git"},{"version":"cd1a677cad994021b19665ed476aea63f5d54f31","status":"affected","lessThan":"6bd8b56899be0b514945f639a89ccafb8f8dfaef","versionType":"git"},{"version":"cd1a677cad994021b19665ed476aea63f5d54f31","status":"affected","lessThan":"cdbc9836c7afadad68f374791738f118263c5371","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ceph/messenger.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.11","versionType":"semver"},{"version":"5.15.194","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.153","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.107","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.48","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.16.8","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ceph/messenger.c"]}],"references":["https://git.kernel.org/stable/c/ea12ab684f8ae8a6da11a22c78d94a79e2163096","https://git.kernel.org/stable/c/591ea9c30737663a471b2bb07b27ddde86b020d5","https://git.kernel.org/stable/c/23538cfbeed87159a5ac6c61e7a6de3d8d4486a8","https://git.kernel.org/stable/c/35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983","https://git.kernel.org/stable/c/6bd8b56899be0b514945f639a89ccafb8f8dfaef","https://git.kernel.org/stable/c/cdbc9836c7afadad68f374791738f118263c5371","https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/39xxx/CVE-2025-39880.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-39880","state":"PUBLISHED","datePublished":"2025-09-23T06:00:49.897Z","dateUpdated":"2026-10-15T22:02:32.742Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:20:57.144Z"},"containers":{"cna":{"title":"libceph: fix invalid accesses to ceph_connection_v1_info","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix invalid accesses to ceph_connection_v1_info\n\nThere is a place where generic code in messenger.c is reading and\nanother place where it is writing to con->v1 union member without\nchecking that the union member is active (i.e. msgr1 is in use).\n\nOn 64-bit systems, con->v1.auth_retry overlaps with con->v2.out_iter,\nso such a read is almost guaranteed to return a bogus value instead of\n0 when msgr2 is in use.  This ends up being fairly benign because the\nside effect is just the invalidation of the authorizer and successive\nfetching of new tickets.\n\ncon->v1.connect_seq overlaps with con->v2.conn_bufs and the fact that\nit's being written to can cause more serious consequences, but luckily\nit's not something that happens often."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"cd1a677cad994021b19665ed476aea63f5d54f31","status":"affected","lessThan":"ea12ab684f8ae8a6da11a22c78d94a79e2163096","versionType":"git"},{"version":"cd1a677cad994021b19665ed476aea63f5d54f31","status":"affected","lessThan":"591ea9c30737663a471b2bb07b27ddde86b020d5","versionType":"git"},{"version":"cd1a677cad994021b19665ed476aea63f5d54f31","status":"affected","lessThan":"23538cfbeed87159a5ac6c61e7a6de3d8d4486a8","versionType":"git"},{"version":"cd1a677cad994021b19665ed476aea63f5d54f31","status":"affected","lessThan":"35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983","versionType":"git"},{"version":"cd1a677cad994021b19665ed476aea63f5d54f31","status":"affected","lessThan":"6bd8b56899be0b514945f639a89ccafb8f8dfaef","versionType":"git"},{"version":"cd1a677cad994021b19665ed476aea63f5d54f31","status":"affected","lessThan":"cdbc9836c7afadad68f374791738f118263c5371","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ceph/messenger.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.11","versionType":"semver"},{"version":"5.15.194","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.153","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.107","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.48","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.16.8","status":"unaffected","lessThanOrEqual":"6.16.*","versionType":"semver"},{"version":"6.17","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ceph/messenger.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ea12ab684f8ae8a6da11a22c78d94a79e2163096"},{"url":"https://git.kernel.org/stable/c/591ea9c30737663a471b2bb07b27ddde86b020d5"},{"url":"https://git.kernel.org/stable/c/23538cfbeed87159a5ac6c61e7a6de3d8d4486a8"},{"url":"https://git.kernel.org/stable/c/35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983"},{"url":"https://git.kernel.org/stable/c/6bd8b56899be0b514945f639a89ccafb8f8dfaef"},{"url":"https://git.kernel.org/stable/c/cdbc9836c7afadad68f374791738f118263c5371"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The faulting/STANDBY transitions that reach both bad accesses are driven by the remote ceph peer's socket behaviour (connection reset, close, or a failed msgr2 handshake) over TCP, so a malicious or compromised MON/OSD/MDS — or an on-path attacker able to disrupt the session — triggers the code remotely. This matches how other libceph peer-data bugs (CVE-2026-22984, CVE-2026-22990) are scored.\nAC:L - No race or unusual precondition is needed: on any msgr2 connection the union misread is essentially deterministic (`v1.auth_retry` aliases a non-NULL pointer's low word), and the `connect_seq++` write happens on every fault-to-STANDBY followed by a queued message or keepalive, both of which the attacker can induce repeatedly by resetting the connection. msgr2 is the standard deployment mode for modern Ceph clusters, not a rare configuration.\nPR:N - The attacker needs no account or privilege on the victim host; it acts as the remote ceph peer or as a network attacker on the connection. The fault path is reachable during the msgr2 handshake before authentication completes, so it is a pre-authentication trigger.\nUI:N - Everything happens inside the libceph connection state machine and its workqueue handler on an already-established CephFS mount or mapped RBD device; no victim action is required at exploit time.\nS:U - The corruption is confined to kernel memory within the same security authority as the vulnerable code; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The confused `v1.auth_retry` read exposes the low 32 bits of a kernel heap pointer (into the connection object) to a branch decision and to the `dout()` log, and the corrupted `conn_bufs[]` pointer can direct handshake buffers — some of which, such as `authorizer_copy`, are copied out and sent to the peer — at unintended kernel memory, yielding attacker-visible disclosure.\nI:H - This is a union type confusion that performs out-of-bounds writes relative to the active member: zeroing half of `v2.out_iter`'s iovec pointer and incrementing half of a `v2.conn_bufs[]` pointer, corrupting kernel pointer state. The maintainer explicitly notes the `connect_seq` write \"can cause more serious consequences,\" and the affected slot varies across the six affected stable branches because of differing struct layouts.\nA:H - A mangled `conn_bufs[]` entry is consumed by `kvfree()` in `free_conn_bufs()` and dereferenced as a handshake buffer, so the corruption can produce an invalid free or wild access resulting in an oops/panic, taking down a storage client node; the attacker can retrigger the condition indefinitely by repeatedly faulting the connection."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:05:50.970Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.194"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.1.153"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.6.107"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.12.48"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.16.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.17"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T17:44:22.996Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-39880","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T21:54:32.238506Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T22:02:32.742Z"}}]}}}