LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info

In the Linux kernel, the following vulnerability has been resolved: libceph: fix invalid accesses to ceph_connection_v1_info There is a place where generic code in messenger.c is reading and another place where it is writing to con->v1 union member without checking that the union member is active (i.e. msgr1 is in use). On 64-bit systems, con->v1.auth_retry overlaps with con->v2.out_iter, so such a read is almost guaranteed to return a bogus value instead of 0 when msgr2 is in use. This ends up being fairly benign because the side effect is just the invalidation of the authorizer and successive fetching of new tickets. con->v1.connect_seq overlaps with con->v2.conn_bufs and the fact that it's being written to can cause more serious consequences, but luckily it's not something that happens often.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A Linux Ceph networking flaw mixes connection data for two messenger protocols. With msgr2 active, code may read or overwrite memory as though msgr1 were active. The read mainly causes unnecessary authentication ticket refreshes; the write may have more serious, unspecified consequences. The CVE is rated 9.8, but the sources do not establish code execution or active exploitation.

Executive priority

Treat this as an urgent preventive update for Ceph-backed infrastructure using affected kernels. Prioritize confirmed libceph and msgr2 deployments rather than every Linux host equally. The critical score justifies prompt action, while the absence of reported exploitation and incomplete impact detail mean this should not be presented as evidence of compromise.

Technical view

Generic libceph messenger code accesses the inactive ceph_connection_v1_info union member without confirming msgr1 use. On 64-bit systems, v1.auth_retry overlaps v2.out_iter, while v1.connect_seq overlaps v2.conn_bufs. Under msgr2, this produces bogus reads and potentially damaging writes. The supplied description does not define the resulting security impact precisely.

Likely exposure

Exposure is highest on Linux hosts using in-kernel Ceph functionality with msgr2. The bundle lists version values from 5.11 through 6.17, but does not provide clear range semantics. Distribution backports may alter status, so version strings alone are insufficient. Systems not using this Ceph path are less likely exposed.

Exploitation context

KEV is false, and no supplied source reports active exploitation or a public exploit. The CVSS vector indicates network reachability, low complexity, and no required privileges or interaction, but scoring does not prove practical exploitability. The kernel description characterizes the read effect as fairly benign and the potentially serious write as uncommon.

Researcher notes

The root cause is unchecked access to an inactive union variant in libceph messenger code. The overlapping fields explain authentication churn and possible corruption of msgr2 connection-buffer state. No CWE is supplied, and the exact security outcome, trigger reliability, affected ranges, and practical remote exploitability remain insufficiently documented in the bundle. Multiple stable-branch fixes are cited.

Mitigation direction

  • Apply a vendor-supported Linux kernel update incorporating the applicable cited stable fix.
  • Consult distribution guidance for fixed packages because vendors may backport patches without changing upstream-style version boundaries.
  • If updating is delayed, obtain vendor-specific mitigation advice; the supplied sources name no workaround.
  • Prioritize remediation on systems actively using libceph with msgr2.

Validation and detection

  • Inventory Linux hosts using in-kernel Ceph functionality and determine whether msgr2 is active.
  • Record each host's running kernel, not merely installed kernel packages.
  • Compare running kernels against distribution advisories and applicable stable fix commits.
  • Verify the deployed kernel package includes the relevant fix or documented backport.
  • Review Ceph logs for repeated authentication ticket fetching as an operational symptom, not proof of exploitation.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39880 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
8Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2025-39880Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxcd1a677cad994021b19665ed476aea63f5d54f31, cd1a677cad994021b19665ed476aea63f5d54f31, cd1a677cad994021b19665ed476aea63f5d54f31, cd1a677cad994021b19665ed476aea63f5d54f31, cd1a677cad994021b19665ed476aea63f5d54f31, cd1a677cad994021b19665ed476aea63f5d54f31unaffected
LinuxLinux5.11, 0, 5.15.194, 6.1.153, 6.6.107, 6.12.48, 6.16.8, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.