CVE-2025-40362 — Insufficient Granularity of Access Control in Linux
Severity
8.4HIGH
No vectorEPSS
0.2%
top 60.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 16
Latest updateFeb 24
Description
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix multifs mds auth caps issue
The mds auth caps check should also validate the
fsname along with the associated caps. Not doing
so would result in applying the mds auth caps of
one fs on to the other fs in a multifs ceph cluster.
The bug causes multiple issues w.r.t user
authentication, following is one such example.
Steps to Reproduce (on vstart cluster):
1. Create two file systems in a cluster, say 'fsname1' and 'fs…
Affected Packages6 packages
▶CVEListV5linux/linux596afb0b8933ba6ed7227adcc538db26feb25c74 — 07640d34a781bb2e39020a39137073c03c4aa932+3
🔴Vulnerability Details
8📋Vendor Advisories
7Red Hat▶
kernel: Linux kernel (ceph): Incorrect authorization allows privilege escalation in multifs clusters↗2025-12-16