Skip to main content

Linux Kernel CVE-2025-68284

CRITICAL
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Linux Red Hat Suse
9.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.1 HIGH

Remote network vector but exploitation needs attacker-controlled/MITM Ceph server during auth, so AC:H; no victim privileges or interaction (PR:N/UI:N); kernel OOB write yields high C/I/A.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.3 HIGH
AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Red Hat
6.5 HIGH
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:15 vuln.today
CVE Published
Dec 16, 2025 - 16:16 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

libceph: prevent potential out-of-bounds writes in handle_auth_session_key()

The len field originates from untrusted network packets. Boundary checks have been added to prevent potential out-of-bounds writes when decrypting the connection secret or processing service tickets.

[ idryomov: changelog ]

AnalysisAI

Out-of-bounds kernel memory write in the Linux kernel's libceph client (handle_auth_session_key) allows a malicious or compromised Ceph server to corrupt kernel memory when a client decrypts the connection secret or processes CephX service tickets. The attacker-controlled 'len' field from network packets was used without boundary checks, enabling potential kernel memory corruption and code execution against any host mounting Ceph/RBD storage. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.18%, 8th percentile).

Technical ContextAI

libceph is the in-kernel client library that implements the Ceph messenger and the CephX authentication protocol for CephFS and RBD (RADOS Block Device) storage. During the authentication handshake, handle_auth_session_key() parses an authentication session-key reply from a Ceph monitor/server, using a length field to size buffers for decrypting the connection secret and copying service tickets. Because that length originates from untrusted network data and was not bounds-checked, the copy/decrypt operations could write past the allocated buffer - a classic out-of-bounds write (CWE-787, tagged 'Buffer Overflow'). The fix adds explicit boundary checks before these writes. The CWE was listed as N/A in the source feed but the described defect is an out-of-bounds/buffer overflow write in kernel space.

Affected ProductsAI

The vulnerability is in the Linux kernel's libceph subsystem (CephFS/RBD client). No exact affected version range is provided in the input; the six references are all git.kernel.org stable-tree fix commits (5ef575834ca9, 6920ff09bf91, 7fce830ecd0a, 8dfcc56af28c, ccbccfba25e9, f22c55a20a2d), indicating the fix was backported across multiple stable series. No CPE strings were supplied, so precise vulnerable kernel versions must be determined from the stable trees these commits were applied to and confirmed against your distribution's kernel. Only hosts that actually use the in-kernel Ceph client (mounting CephFS or mapping RBD devices) are affected.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the stable-tree commits referenced (e.g., https://git.kernel.org/stable/c/5ef575834ca99f719d7573cdece9df2fe2b72424 and the five sibling commits) by updating to a distribution kernel that incorporates them, and rebooting. Because the input provides no tagged release version, do not assume a specific version number; instead track your distro vendor's advisory for the kernel build that includes these libceph boundary-check commits. As compensating controls until patched: restrict Ceph client traffic so kernels only reach trusted, authenticated monitors/OSDs (network-segment the storage/cluster network and firewall the Ceph monitor ports, typically 3300 and 6789, from untrusted hosts) to remove attacker control of the server side; where feasible, prefer userspace Ceph clients (libcephfs/rbd-nbd) on exposed hosts to take the vulnerable kernel path out of scope. Trade-off: network segmentation does not help against a compromised legitimate monitor, and switching to userspace clients can change performance and mount semantics.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-68284 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy