CVE-2025-21737

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-21737
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21737.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-21737
Downstream
Related
Published
2025-02-27T02:12:13.434Z
Modified
2025-11-20T08:02:52.914164Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
ceph: fix memory leak in ceph_mds_auth_match()
Details

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix memory leak in cephmdsauth_match()

We now free the temporary target path substring allocation on every possible branch, instead of omitting the default branch. In some cases, a memory leak occured, which could rapidly crash the system (depending on how many file accesses were attempted).

This was detected in production because it caused a continuous memory growth, eventually triggering kernel OOM and completely hard-locking the kernel.

Relevant kmemleak stacktrace:

unreferenced object 0xffff888131e69900 (size 128):
  comm "git", pid 66104, jiffies 4295435999
  hex dump (first 32 bytes):
    76 6f 6c 75 6d 65 73 2f 63 6f 6e 74 61 69 6e 65  volumes/containe
    72 73 2f 67 69 74 65 61 2f 67 69 74 65 61 2f 67  rs/gitea/gitea/g
  backtrace (crc 2f3bb450):
    [<ffffffffaa68fb49>] __kmalloc_noprof+0x359/0x510
    [<ffffffffc32bf1df>] ceph_mds_check_access+0x5bf/0x14e0 [ceph]
    [<ffffffffc3235722>] ceph_open+0x312/0xd80 [ceph]
    [<ffffffffaa7dd786>] do_dentry_open+0x456/0x1120
    [<ffffffffaa7e3729>] vfs_open+0x79/0x360
    [<ffffffffaa832875>] path_openat+0x1de5/0x4390
    [<ffffffffaa834fcc>] do_filp_open+0x19c/0x3c0
    [<ffffffffaa7e44a1>] do_sys_openat2+0x141/0x180
    [<ffffffffaa7e4945>] __x64_sys_open+0xe5/0x1a0
    [<ffffffffac2cc2f7>] do_syscall_64+0xb7/0x210
    [<ffffffffac400130>] entry_SYSCALL_64_after_hwframe+0x77/0x7f

It can be triggered by mouting a subdirectory of a CephFS filesystem, and then trying to access files on this subdirectory with an auth token using a path-scoped capability:

$ ceph auth get client.services
[client.services]
        key = REDACTED
        caps mds = "allow rw fsname=cephfs path=/volumes/"
        caps mon = "allow r fsname=cephfs"
        caps osd = "allow rw tag cephfs data=cephfs"

$ cat /proc/self/mounts
services@[REDACTED].cephfs=/volumes/containers /ceph/containers ceph rw,noatime,name=services,secret=<hidden>,ms_mode=prefer-crc,mount_timeout=300,acl,mon_addr=[REDACTED]:3300,recover_session=clean 0 0

$ seq 1 1000000 | xargs -P32 --replace={} touch /ceph/containers/file-{} && \
seq 1 1000000 | xargs -P32 --replace={} cat /ceph/containers/file-{}

[ idryomov: combine if statements, rename rc to path_matched and make it a bool, formatting ]

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
596afb0b8933ba6ed7227adcc538db26feb25c74
Fixed
146109fe936ac07f8f60cd6267543688985b96bc
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
596afb0b8933ba6ed7227adcc538db26feb25c74
Fixed
2b6086c5efe5c7bd6e0eb440d96c26ca0d20d9d7
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
596afb0b8933ba6ed7227adcc538db26feb25c74
Fixed
3b7d93db450e9d8ead80d75e2a303248f1528c35

Affected versions

v6.*

v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.11
v6.11-rc1
v6.11-rc2
v6.11-rc3
v6.11-rc4
v6.11-rc5
v6.11-rc6
v6.11-rc7
v6.12
v6.12-rc1
v6.12-rc2
v6.12-rc3
v6.12-rc4
v6.12-rc5
v6.12-rc6
v6.12-rc7
v6.12.1
v6.12.10
v6.12.11
v6.12.12
v6.12.13
v6.12.2
v6.12.3
v6.12.4
v6.12.5
v6.12.6
v6.12.7
v6.12.8
v6.12.9
v6.13
v6.13-rc1
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.13-rc6
v6.13-rc7
v6.13.1
v6.13.2

Database specific

vanir_signatures

[
    {
        "id": "CVE-2025-21737-3ed33aad",
        "target": {
            "file": "fs/ceph/mds_client.c",
            "function": "ceph_mds_auth_match"
        },
        "digest": {
            "length": 1978.0,
            "function_hash": "64944583764552406899793025229106338750"
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b6086c5efe5c7bd6e0eb440d96c26ca0d20d9d7",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2025-21737-7bcfb02a",
        "target": {
            "file": "fs/ceph/mds_client.c",
            "function": "ceph_mds_auth_match"
        },
        "digest": {
            "length": 1978.0,
            "function_hash": "64944583764552406899793025229106338750"
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@146109fe936ac07f8f60cd6267543688985b96bc",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2025-21737-936e2fda",
        "target": {
            "file": "fs/ceph/mds_client.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "163781093501650816775500835190340108965",
                "207927874080454794457523845514458133584",
                "320595137622155815589659366306883019830",
                "183924959299878132767208568647027440775",
                "178630564076589030644956646517981686453",
                "324059396671030354787627269332627861144",
                "275405871513934090167698286341667112429",
                "171767792093924921485210630486950371453",
                "223967833325602508657612660443153835192",
                "244538290290823870813762706886140687454",
                "324059396671030354787627269332627861144",
                "143892899838461869017538388229159807354",
                "6787890327123429999107524848591567269",
                "58985559615713431274681103464626493597"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b6086c5efe5c7bd6e0eb440d96c26ca0d20d9d7",
        "signature_version": "v1"
    },
    {
        "id": "CVE-2025-21737-feacd749",
        "target": {
            "file": "fs/ceph/mds_client.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "163781093501650816775500835190340108965",
                "207927874080454794457523845514458133584",
                "320595137622155815589659366306883019830",
                "183924959299878132767208568647027440775",
                "178630564076589030644956646517981686453",
                "324059396671030354787627269332627861144",
                "275405871513934090167698286341667112429",
                "171767792093924921485210630486950371453",
                "223967833325602508657612660443153835192",
                "244538290290823870813762706886140687454",
                "324059396671030354787627269332627861144",
                "143892899838461869017538388229159807354",
                "6787890327123429999107524848591567269",
                "58985559615713431274681103464626493597"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@146109fe936ac07f8f60cd6267543688985b96bc",
        "signature_version": "v1"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.10.0
Fixed
6.12.14
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.13.3