In the Linux kernel, the following vulnerability has been resolved:
ceph: fix multifs mds auth caps issue
The mds auth caps check should also validate the fsname along with the associated caps. Not doing so would result in applying the mds auth caps of one fs on to the other fs in a multifs ceph cluster. The bug causes multiple issues w.r.t user authentication, following is one such example.
Steps to Reproduce (on vstart cluster): 1. Create two file systems in a cluster, say 'fsname1' and 'fsname2' 2. Authorize read only permission to the user 'client.usr' on fs 'fsname1' $ceph fs authorize fsname1 client.usr / r 3. Authorize read and write permission to the same user 'client.usr' on fs 'fsname2' $ceph fs authorize fsname2 client.usr / rw 4. Update the keyring $ceph auth get client.usr >> ./keyring
With above permssions for the user 'client.usr', following is the expectation. a. The 'client.usr' should be able to only read the contents and not allowed to create or delete files on file system 'fsname1'. b. The 'client.usr' should be able to read/write on file system 'fsname2'.
But, with this bug, the 'client.usr' is allowed to read/write on file system 'fsname1'. See below.
5. Mount the file system 'fsname1' with the user 'client.usr' $sudo bin/mount.ceph [email protected]=/ /kmnt_fsname1_usr/ 6. Try creating a file on file system 'fsname1' with user 'client.usr'. This should fail but passes with this bug. $touch /kmnt_fsname1_usr/file1 7. Mount the file system 'fsname1' with the user 'client.admin' and create a file. $sudo bin/mount.ceph [email protected]=/ /kmnt_fsname1_admin $echo "data" > /kmnt_fsname1_admin/admin_file1 8. Try removing an existing file on file system 'fsname1' with the user 'client.usr'. This shoudn't succeed but succeeds with the bug. $rm -f /kmnt_fsname1_usr/admin_file1
For more information, please take a look at the corresponding mds/fuse patch and tests added by looking into the tracker mentioned below.
v2: Fix a possible null dereference in doutc v3: Don't store fsname from mdsmap, validate against ceph_mount_options's fsname and use it v4: Code refactor, better warning message and fix possible compiler warning
[ Slava.Dubeyko: "fsname check failed" -> "fsname mismatch" ]
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.12-libbpf-staticUpgrade bpftool6.12Upgrade kernel6.12-libbpf-develUpgrade kernel6.12-debuginfoUpgrade kernel6.12-tools-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel6.12-libbpfUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade python3-perf6.12Upgrade kernel6.12-headersUpgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12Upgrade kernel6.12-debuginfo-common-aarch64Upgrade perf6.12Upgrade kernel6.12-tools-develUpgrade kernel-livepatch-6.12.58-82.121Upgrade kernel6.12-toolsUpgrade kernel6.12-modules-extraUpgrade bpftool6.12-debuginfo | Apr 7, 2026 | Dec 16, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade kernel-uek | Jan 15, 2026 | Dec 16, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 16, 2025 |
| Ubuntu | — | Upgrade linux-image-6.17.0-14-generic-64kUpgrade linux-image-aws-6.17Upgrade linux-image-6.17.0-1011-oemUpgrade linux-image-generic-64kUpgrade linux-image-6.17.0-1008-raspiUpgrade linux-image-oracle-6.17Upgrade linux-image-6.17.0-1007-aws-64kUpgrade linux-image-6.17.0-1007-gcp-64kUpgrade linux-image-azure-6.17Upgrade linux-image-generic-6.17Upgrade linux-image-oracle-64k-6.17Upgrade linux-image-genericUpgrade linux-image-6.17.0-1008-azureUpgrade linux-image-gcp-64k-6.17Upgrade linux-image-6.17.0-14-genericUpgrade linux-image-oracleUpgrade linux-image-virtualUpgrade linux-image-oracle-64kUpgrade linux-image-6.17.0-1006-realtimeUpgrade linux-image-virtual-6.17Upgrade linux-image-gcp-64kUpgrade linux-image-realtime-6.17Upgrade linux-image-generic-64k-6.17Upgrade linux-image-azureUpgrade linux-image-awsUpgrade linux-image-6.17.0-1007-oracle-64kUpgrade linux-image-gcpUpgrade linux-image-oem-6.17Upgrade linux-image-aws-64k-6.17Upgrade linux-image-realtimeUpgrade linux-image-6.17.0-1007-oracleUpgrade linux-image-6.17.0-1007-awsUpgrade linux-image-aws-64kUpgrade linux-image-raspiUpgrade linux-image-raspi-6.17Upgrade linux-image-6.17.0-1007-gcpUpgrade linux-image-gcp-6.17 | Feb 13, 2026 | Feb 12, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub