CVE-2025-39880

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-39880", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.144Z", "datePublished": "2025-09-23T06:00:49.897Z", "dateUpdated": "2026-10-15T22:02:32.742Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:50.970Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix invalid accesses to ceph_connection_v1_info\n\nThere is a place where generic code in messenger.c is reading and\nanother place where it is writing to con->v1 union member without\nchecking that the union member is active (i.e. msgr1 is in use).\n\nOn 64-bit systems, con->v1.auth_retry overlaps with con->v2.out_iter,\nso such a read is almost guaranteed to return a bogus value instead of\n0 when msgr2 is in use. This ends up being fairly benign because the\nside effect is just the invalidation of the authorizer and successive\nfetching of new tickets.\n\ncon->v1.connect_seq overlaps with con->v2.conn_bufs and the fact that\nit's being written to can cause more serious consequences, but luckily\nit's not something that happens often."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The faulting/STANDBY transitions that reach both bad accesses are driven by the remote ceph peer's socket behaviour (connection reset, close, or a failed msgr2 handshake) over TCP, so a malicious or compromised MON/OSD/MDS \u2014 or an on-path attacker able to disrupt the session \u2014 triggers the code remotely. This matches how other libceph peer-data bugs (CVE-2026-22984, CVE-2026-22990) are scored.\nAC:L - No race or unusual precondition is needed: on any msgr2 connection the union misread is essentially deterministic (`v1.auth_retry` aliases a non-NULL pointer's low word), and the `connect_seq++` write happens on every fault-to-STANDBY followed by a queued message or keepalive, both of which the attacker can induce repeatedly by resetting the connection. msgr2 is the standard deployment mode for modern Ceph clusters, not a rare configuration.\nPR:N - The attacker needs no account or privilege on the victim host; it acts as the remote ceph peer or as a network attacker on the connection. The fault path is reachable during the msgr2 handshake before authentication completes, so it is a pre-authentication trigger.\nUI:N - Everything happens inside the libceph connection state machine and its workqueue handler on an already-established CephFS mount or mapped RBD device; no victim action is required at exploit time.\nS:U - The corruption is confined to kernel memory within the same security authority as the vulnerable code; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The confused `v1.auth_retry` read exposes the low 32 bits of a kernel heap pointer (into the connection object) to a branch decision and to the `dout()` log, and the corrupted `conn_bufs[]` pointer can direct handshake buffers \u2014 some of which, such as `authorizer_copy`, are copied out and sent to the peer \u2014 at unintended kernel memory, yielding attacker-visible disclosure.\nI:H - This is a union type confusion that performs out-of-bounds writes relative to the active member: zeroing half of `v2.out_iter`'s iovec pointer and incrementing half of a `v2.conn_bufs[]` pointer, corrupting kernel pointer state. The maintainer explicitly notes the `connect_seq` write \"can cause more serious consequences,\" and the affected slot varies across the six affected stable branches because of differing struct layouts.\nA:H - A mangled `conn_bufs[]` entry is consumed by `kvfree()` in `free_conn_bufs()` and dereferenced as a handshake buffer, so the corruption can produce an invalid free or wild access resulting in an oops/panic, taking down a storage client node; the attacker can retrigger the condition indefinitely by repeatedly faulting the connection."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ceph/messenger.c"], "versions": [{"version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "ea12ab684f8ae8a6da11a22c78d94a79e2163096", "status": "affected", "versionType": "git"}, {"version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "591ea9c30737663a471b2bb07b27ddde86b020d5", "status": "affected", "versionType": "git"}, {"version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "23538cfbeed87159a5ac6c61e7a6de3d8d4486a8", "status": "affected", "versionType": "git"}, {"version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983", "status": "affected", "versionType": "git"}, {"version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "6bd8b56899be0b514945f639a89ccafb8f8dfaef", "status": "affected", "versionType": "git"}, {"version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "cdbc9836c7afadad68f374791738f118263c5371", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ceph/messenger.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.194", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.153", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.107", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.48", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.8", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.194"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.153"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.107"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.48"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.16.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ea12ab684f8ae8a6da11a22c78d94a79e2163096"}, {"url": "https://git.kernel.org/stable/c/591ea9c30737663a471b2bb07b27ddde86b020d5"}, {"url": "https://git.kernel.org/stable/c/23538cfbeed87159a5ac6c61e7a6de3d8d4486a8"}, {"url": "https://git.kernel.org/stable/c/35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983"}, {"url": "https://git.kernel.org/stable/c/6bd8b56899be0b514945f639a89ccafb8f8dfaef"}, {"url": "https://git.kernel.org/stable/c/cdbc9836c7afadad68f374791738f118263c5371"}], "title": "libceph: fix invalid accesses to ceph_connection_v1_info", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:44:22.996Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-39880", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:54:32.238506Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:32.742Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:44:22.996Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-39880", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:54:32.238506Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:54:33.196Z"}}], "cna": {"title": "libceph: fix invalid accesses to ceph_connection_v1_info", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The faulting/STANDBY transitions that reach both bad accesses are driven by the remote ceph peer's socket behaviour (connection reset, close, or a failed msgr2 handshake) over TCP, so a malicious or compromised MON/OSD/MDS \u2014 or an on-path attacker able to disrupt the session \u2014 triggers the code remotely. This matches how other libceph peer-data bugs (CVE-2026-22984, CVE-2026-22990) are scored.\nAC:L - No race or unusual precondition is needed: on any msgr2 connection the union misread is essentially deterministic (`v1.auth_retry` aliases a non-NULL pointer's low word), and the `connect_seq++` write happens on every fault-to-STANDBY followed by a queued message or keepalive, both of which the attacker can induce repeatedly by resetting the connection. msgr2 is the standard deployment mode for modern Ceph clusters, not a rare configuration.\nPR:N - The attacker needs no account or privilege on the victim host; it acts as the remote ceph peer or as a network attacker on the connection. The fault path is reachable during the msgr2 handshake before authentication completes, so it is a pre-authentication trigger.\nUI:N - Everything happens inside the libceph connection state machine and its workqueue handler on an already-established CephFS mount or mapped RBD device; no victim action is required at exploit time.\nS:U - The corruption is confined to kernel memory within the same security authority as the vulnerable code; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The confused `v1.auth_retry` read exposes the low 32 bits of a kernel heap pointer (into the connection object) to a branch decision and to the `dout()` log, and the corrupted `conn_bufs[]` pointer can direct handshake buffers \u2014 some of which, such as `authorizer_copy`, are copied out and sent to the peer \u2014 at unintended kernel memory, yielding attacker-visible disclosure.\nI:H - This is a union type confusion that performs out-of-bounds writes relative to the active member: zeroing half of `v2.out_iter`'s iovec pointer and incrementing half of a `v2.conn_bufs[]` pointer, corrupting kernel pointer state. The maintainer explicitly notes the `connect_seq` write \"can cause more serious consequences,\" and the affected slot varies across the six affected stable branches because of differing struct layouts.\nA:H - A mangled `conn_bufs[]` entry is consumed by `kvfree()` in `free_conn_bufs()` and dereferenced as a handshake buffer, so the corruption can produce an invalid free or wild access resulting in an oops/panic, taking down a storage client node; the attacker can retrigger the condition indefinitely by repeatedly faulting the connection."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "ea12ab684f8ae8a6da11a22c78d94a79e2163096", "versionType": "git"}, {"status": "affected", "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "591ea9c30737663a471b2bb07b27ddde86b020d5", "versionType": "git"}, {"status": "affected", "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "23538cfbeed87159a5ac6c61e7a6de3d8d4486a8", "versionType": "git"}, {"status": "affected", "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983", "versionType": "git"}, {"status": "affected", "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "6bd8b56899be0b514945f639a89ccafb8f8dfaef", "versionType": "git"}, {"status": "affected", "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "lessThan": "cdbc9836c7afadad68f374791738f118263c5371", "versionType": "git"}], "programFiles": ["net/ceph/messenger.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"status": "unaffected", "version": "0", "lessThan": "5.11", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.194", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.153", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.107", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.48", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.16.8", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ceph/messenger.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ea12ab684f8ae8a6da11a22c78d94a79e2163096"}, {"url": "https://git.kernel.org/stable/c/591ea9c30737663a471b2bb07b27ddde86b020d5"}, {"url": "https://git.kernel.org/stable/c/23538cfbeed87159a5ac6c61e7a6de3d8d4486a8"}, {"url": "https://git.kernel.org/stable/c/35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983"}, {"url": "https://git.kernel.org/stable/c/6bd8b56899be0b514945f639a89ccafb8f8dfaef"}, {"url": "https://git.kernel.org/stable/c/cdbc9836c7afadad68f374791738f118263c5371"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix invalid accesses to ceph_connection_v1_info\n\nThere is a place where generic code in messenger.c is reading and\nanother place where it is writing to con->v1 union member without\nchecking that the union member is active (i.e. msgr1 is in use).\n\nOn 64-bit systems, con->v1.auth_retry overlaps with con->v2.out_iter,\nso such a read is almost guaranteed to return a bogus value instead of\n0 when msgr2 is in use. This ends up being fairly benign because the\nside effect is just the invalidation of the authorizer and successive\nfetching of new tickets.\n\ncon->v1.connect_seq overlaps with con->v2.conn_bufs and the fact that\nit's being written to can cause more serious consequences, but luckily\nit's not something that happens often."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.194", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.153", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.107", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.48", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16.8", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17", "versionStartIncluding": "5.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:50.970Z"}}}, "cveMetadata": {"cveId": "CVE-2025-39880", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:32.742Z", "dateReserved": "2025-04-16T07:20:57.144Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-09-23T06:00:49.897Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ceph/messenger.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ea12ab684f8ae8a6da11a22c78d94a79e2163096", "status": "affected", "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "versionType": "git"}, {"lessThan": "591ea9c30737663a471b2bb07b27ddde86b020d5", "status": "affected", "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "versionType": "git"}, {"lessThan": "23538cfbeed87159a5ac6c61e7a6de3d8d4486a8", "status": "affected", "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "versionType": "git"}, {"lessThan": "35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983", "status": "affected", "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "versionType": "git"}, {"lessThan": "6bd8b56899be0b514945f639a89ccafb8f8dfaef", "status": "affected", "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "versionType": "git"}, {"lessThan": "cdbc9836c7afadad68f374791738f118263c5371", "status": "affected", "version": "cd1a677cad994021b19665ed476aea63f5d54f31", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ceph/messenger.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"lessThan": "5.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.194", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.153", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.107", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.48", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF862263-DC8D-4324-A52A-DA1D7880B35A", "versionEndExcluding": "5.15.194", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "39B3B4F7-FA64-4E7C-B55D-53A5D004A639", "versionEndExcluding": "6.1.153", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D273EDA6-2CFE-4EBD-B024-62EB057830F3", "versionEndExcluding": "6.6.107", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9652E701-5C8E-49CF-89A5-499E214A5902", "versionEndExcluding": "6.12.48", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8DA00A4E-AABB-4A69-AB39-67B22D0B36D2", "versionEndExcluding": "6.16.8", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*", "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*", "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*", "matchCriteriaId": "47E4C5C0-079F-4838-971B-8C503D48FCC2", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix invalid accesses to ceph_connection_v1_info\n\nThere is a place where generic code in messenger.c is reading and\nanother place where it is writing to con->v1 union member without\nchecking that the union member is active (i.e. msgr1 is in use).\n\nOn 64-bit systems, con->v1.auth_retry overlaps with con->v2.out_iter,\nso such a read is almost guaranteed to return a bogus value instead of\n0 when msgr2 is in use. This ends up being fairly benign because the\nside effect is just the invalidation of the authorizer and successive\nfetching of new tickets.\n\ncon->v1.connect_seq overlaps with con->v2.conn_bufs and the fact that\nit's being written to can cause more serious consequences, but luckily\nit's not something that happens often."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nlibceph: corrige accesos inv\u00e1lidos a ceph_connection_v1_info\n\nHay un lugar donde el c\u00f3digo gen\u00e9rico en messenger.c est\u00e1 leyendo y otro lugar donde est\u00e1 escribiendo al miembro de la uni\u00f3n con->v1 sin verificar que el miembro de la uni\u00f3n est\u00e9 activo (es decir, msgr1 est\u00e1 en uso).\n\nEn sistemas de 64 bits, con->v1.auth_retry se superpone con con->v2.out_iter, por lo que dicha lectura est\u00e1 casi garantizada para devolver un valor err\u00f3neo en lugar de 0 cuando msgr2 est\u00e1 en uso. Esto termina siendo bastante benigno porque el efecto secundario es solo la invalidaci\u00f3n del autorizador y la obtenci\u00f3n sucesiva de nuevos tickets.\n\ncon->v1.connect_seq se superpone con con->v2.conn_bufs y el hecho de que se est\u00e9 escribiendo en \u00e9l puede causar consecuencias m\u00e1s graves, pero afortunadamente no es algo que ocurra a menudo."}], "id": "CVE-2025-39880", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-39880", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:54:32.238506Z", "version": "2.0.3"}}]}, "published": "2025-09-23T06:15:47.663", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/23538cfbeed87159a5ac6c61e7a6de3d8d4486a8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/591ea9c30737663a471b2bb07b27ddde86b020d5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6bd8b56899be0b514945f639a89ccafb8f8dfaef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cdbc9836c7afadad68f374791738f118263c5371"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ea12ab684f8ae8a6da11a22c78d94a79e2163096"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-704"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: libceph: fix invalid accesses to ceph_connection_v1_info", "id": "2397567", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397567"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-39880", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-09-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-39880\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-39880\nhttps://lore.kernel.org/linux-cve-announce/2025092301-CVE-2025-39880-17c5@gregkh/T"], "threat_severity": "Important"}

{"created": "2025-09-23T16:03:20.059253+00:00", "updated": "2025-09-23T16:03:20.059331+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}