CVE-2025-21737
published 2025-02-27CVE-2025-21737: In the Linux kernel, the following vulnerability has been resolved: ceph: fix memory leak in ceph_mds_auth_match() We now free the temporary target path…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.21%
10.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix memory leak in ceph_mds_auth_match()
We now free the temporary target path substring allocation on every
possible branch, instead of omitting the default branch. In some
cases, a memory leak occured, which could rapidly crash the system
(depending on how many file accesses were attempted).
This was detected in production because it caused a continuous memory
growth, eventually triggering kernel OOM and completely hard-locking
the kernel.
Relevant kmemleak stacktrace:
unreferenced object 0xffff888131e69900 (size 128):
comm "git", pid 66104, jiffies 4295435999
hex dump (first 32 bytes):
76 6f 6c 75 6d 65 73 2f 63 6f 6e 74 61 69 6e 65 volumes/containe
72 73 2f 67 69 74 65 61 2f 67 69 74 65 61 2f 67 rs/gitea/gitea/g
backtrace (crc 2f3bb450):
[] __kmalloc_noprof+0x359/0x510
[] ceph_mds_check_access+0x5bf/0x14e0 [ceph]
[] ceph_open+0x312/0xd80 [ceph]
[] do_dentry_open+0x456/0x1120
[] vfs_open+0x79/0x360
[] path_openat+0x1de5/0x4390
[] do_filp_open+0x19c/0x3c0
[] do_sys_openat2+0x141/0x180
[] __x64_sys_open+0xe5/0x1a0
[] do_syscall_64+0xb7/0x210
[] entry_SYSCALL_64_after_hwframe+0x77/0x7f
It can be triggered by mouting a subdirectory of a CephFS filesystem,
and then trying to access files on this subdirectory with an auth token
using a path-scoped capability:
$ ceph auth get client.services
[client.services]
key = REDACTED
caps mds = "allow rw fsname=cephfs path=/volumes/"
caps mon = "allow r fsname=cephfs"
caps osd = "allow rw tag cephfs data=cephfs"
$ cat /proc/self/mounts
services@[REDACTED].cephfs=/volumes/containers /ceph/containers ceph rw,noatime,name=services,secret=,ms_mode=prefer-crc,mount_timeout=300,acl,mon_addr=[REDACTED]:3300,recover_session=clean 0 0
$ seq 1 1000000 | xargs -P32 --replace={} touch /ceph/containers/file-{} && \
seq 1 1000000 | xargs -P32 --replace={} cat /ceph/containers/file-{}
[ idryomov: combine if statements, rename rc to path_matched and make
it a boo
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.12.15-1 (forky) | linux 6.12.15-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 596afb0b8933ba6ed7227adcc538db26feb25c74 < 146109fe936ac07f8f60cd6267543688985b96bc | 146109fe936ac07f8f60cd6267543688985b96bc |
| linux | linux | >= 596afb0b8933ba6ed7227adcc538db26feb25c74 < 2b6086c5efe5c7bd6e0eb440d96c26ca0d20d9d7 | 2b6086c5efe5c7bd6e0eb440d96c26ca0d20d9d7 |
| linux | linux | >= 596afb0b8933ba6ed7227adcc538db26feb25c74 < 3b7d93db450e9d8ead80d75e2a303248f1528c35 | 3b7d93db450e9d8ead80d75e2a303248f1528c35 |
| linux | linux_kernel | >= 0 < 6.12.15-1 | 6.12.15-1 |
| linux | linux_kernel | >= 0 < 6.12.15-1 | 6.12.15-1 |
| linux | linux_kernel | >= 6.10 < 6.12.14 | 6.12.14 |
| linux | linux_kernel | >= 6.13 < 6.13.3 | 6.13.3 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.12.13/6.13.2 ceph_mds_auth_match memory leak (Nessus ID 236983 / WID-SEC-2025-0453)
vuldb·2026-05-25·CVSS 5.5
CVE-2025-21737 [MEDIUM] Linux Kernel up to 6.12.13/6.13.2 ceph_mds_auth_match memory leak (Nessus ID 236983 / WID-SEC-2025-0453)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.12.13/6.13.2. This vulnerability affects the function ceph_mds_auth_match. Performing a manipulation results in memory leak.
This vulnerability was named CVE-2025-21737. The attack needs to be approached within the local network. There is no available exploit.
You should upgrade the affected component.
OSV
linux-lowlatency, linux-lowlatency-hwe-6.11, linux-oracle vulnerabilities
osv·2025-05-28
linux-lowlatency, linux-lowlatency-hwe-6.11, linux-oracle vulnerabilities
linux-lowlatency, linux-lowlatency-hwe-6.11, linux-oracle vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Serial ATA and Parallel ATA drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Hardware crypto device drivers;
- FireWire subsystem;
- EFI core;
- Qualcomm firmware drivers;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- I3C subsystem;
- InfiniBand drivers;
- Input Device (Mouse) drivers;
- IOMMU subsystem;
- Multiple dev
OSV
linux-aws vulnerabilities
osv·2025-05-22
linux-aws vulnerabilities
linux-aws vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Serial ATA and Parallel ATA drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Hardware crypto device drivers;
- FireWire subsystem;
- EFI core;
- Qualcomm firmware drivers;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- I3C subsystem;
- InfiniBand drivers;
- Input Device (Mouse) drivers;
- IOMMU subsystem;
- Multiple devices driver;
- Media drivers;
- NVIDIA Tegra mem
OSV
linux, linux-azure, linux-azure-6.11, linux-gcp, linux-gcp-6.11, linux-hwe-6.11, linux-oem-6.11, linux-raspi, linux-realtime vulnerabilities
osv·2025-05-20
linux, linux-azure, linux-azure-6.11, linux-gcp, linux-gcp-6.11, linux-hwe-6.11, linux-oem-6.11, linux-raspi, linux-realtime vulnerabilities
linux, linux-azure, linux-azure-6.11, linux-gcp, linux-gcp-6.11, linux-hwe-6.11, linux-oem-6.11, linux-raspi, linux-realtime vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Serial ATA and Parallel ATA drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Hardware crypto device drivers;
- FireWire subsystem;
- EFI core;
- Qualcomm firmware drivers;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- I3C subsystem;
- InfiniBand drivers
OSV
CVE-2025-21737: In the Linux kernel, the following vulnerability has been resolved: ceph: fix memory leak in ceph_mds_auth_match() We now free the temporary target pa
osv·2025-02-27·CVSS 5.5
CVE-2025-21737 [MEDIUM] CVE-2025-21737: In the Linux kernel, the following vulnerability has been resolved: ceph: fix memory leak in ceph_mds_auth_match() We now free the temporary target pa
In the Linux kernel, the following vulnerability has been resolved: ceph: fix memory leak in ceph_mds_auth_match() We now free the temporary target path substring allocation on every possible branch, instead of omitting the default branch. In some cases, a memory leak occured, which could rapidly crash the system (depending on how many file accesses were attempted). This was detected in production because it caused a continuous memory growth, eventually triggering kernel OOM and completely hard-locking the kernel. Relevant kmemleak stacktrace: unreferenced object 0xffff888131e69900 (size 128): comm "git", pid 66104, jiffies 4295435999 hex dump (first 32 bytes): 76 6f 6c 75 6d 65 73 2f 63 6f 6e 74 61 69 6e 65 volumes/containe 72 73 2f 67 69 74 65 61 2f 67 69 74 65 61 2f 67 rs/gitea/gitea/g
GHSA
GHSA-755w-2h7x-xvj6: In the Linux kernel, the following vulnerability has been resolved:
ceph: fix memory leak in ceph_mds_auth_match()
We now free the temporary target
ghsa_unreviewed·2025-02-27
CVE-2025-21737 [MEDIUM] CWE-401 GHSA-755w-2h7x-xvj6: In the Linux kernel, the following vulnerability has been resolved:
ceph: fix memory leak in ceph_mds_auth_match()
We now free the temporary target
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix memory leak in ceph_mds_auth_match()
We now free the temporary target path substring allocation on every
possible branch, instead of omitting the default branch. In some
cases, a memory leak occured, which could rapidly crash the system
(depending on how many file accesses were attempted).
This was detected in production because it caused a continuous memory
growth, eventually triggering kernel OOM and completely hard-locking
the kernel.
Relevant kmemleak stacktrace:
unreferenced object 0xffff888131e69900 (size 128):
comm "git", pid 66104, jiffies 4295435999
hex dump (first 32 bytes):
76 6f 6c 75 6d 65 73 2f 63 6f 6e 74 61 69 6e 65 volumes/containe
72 73 2f 67 69 74 65 61 2f 67 69 74 65 61 2f 67 rs/gitea/git
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2025-05-28
CVE-2024-57977 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Serial ATA and Parallel ATA drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Hardware crypto device drivers;
- FireWire subsystem;
- EFI core;
- Qualcomm firmware drivers;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- I3C subsystem;
- InfiniBand drivers;
- Input Device (Mouse) drivers;
- IOM
Ubuntu
Linux kernel (AWS) vulnerabilities
vendor_ubuntu·2025-05-22
CVE-2025-21716 Linux kernel (AWS) vulnerabilities
Title: Linux kernel (AWS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Serial ATA and Parallel ATA drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Hardware crypto device drivers;
- FireWire subsystem;
- EFI core;
- Qualcomm firmware drivers;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- I3C subsystem;
- InfiniBand drivers;
- Input Device (Mouse) drivers;
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2025-05-20
CVE-2025-21716 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Serial ATA and Parallel ATA drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Hardware crypto device drivers;
- FireWire subsystem;
- EFI core;
- Qualcomm firmware drivers;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- I3C subsystem;
- InfiniBand drivers;
- Input Device (Mouse) drivers;
- IOM
Red Hat
kernel: ceph: fix memory leak in ceph_mds_auth_match()
vendor_redhat·2025-02-27·CVSS 5.5
CVE-2025-21737 [MEDIUM] CWE-401 kernel: ceph: fix memory leak in ceph_mds_auth_match()
kernel: ceph: fix memory leak in ceph_mds_auth_match()
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix memory leak in ceph_mds_auth_match()
We now free the temporary target path substring allocation on every
possible branch, instead of omitting the default branch. In some
cases, a memory leak occured, which could rapidly crash the system
(depending on how many file accesses were attempted).
This was detected in production because it caused a continuous memory
growth, eventually triggering kernel OOM and completely hard-locking
the kernel.
Relevant kmemleak stacktrace:
unreferenced object 0xffff888131e69900 (size 128):
comm "git", pid 66104, jiffies 4295435999
hex dump (first 32 bytes):
76 6f 6c 75 6d 65 73 2f 63 6f 6e 74 61 69 6e 65 volumes/containe
72 73 2f
Debian
CVE-2025-21737: linux - In the Linux kernel, the following vulnerability has been resolved: ceph: fix m...
vendor_debian·2025·CVSS 5.5
CVE-2025-21737 [MEDIUM] CVE-2025-21737: linux - In the Linux kernel, the following vulnerability has been resolved: ceph: fix m...
In the Linux kernel, the following vulnerability has been resolved: ceph: fix memory leak in ceph_mds_auth_match() We now free the temporary target path substring allocation on every possible branch, instead of omitting the default branch. In some cases, a memory leak occured, which could rapidly crash the system (depending on how many file accesses were attempted). This was detected in production because it caused a continuous memory growth, eventually triggering kernel OOM and completely hard-locking the kernel. Relevant kmemleak stacktrace: unreferenced object 0xffff888131e69900 (size 128): comm "git", pid 66104, jiffies 4295435999 hex dump (first 32 bytes): 76 6f 6c 75 6d 65 73 2f 63 6f 6e 74 61 69 6e 65 volumes/containe 72 73 2f 67 69 74 65 61 2f 67 69 74 65 61 2f 67 rs/gitea/gitea/g
No detection rules found.
No public exploits indexed.
2025-02-27
Published