CVE-2025-21737

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ceph: fix memory leak in ceph_mds_auth_match()<br /> <br /> We now free the temporary target path substring allocation on every<br /> possible branch, instead of omitting the default branch. In some<br /> cases, a memory leak occured, which could rapidly crash the system<br /> (depending on how many file accesses were attempted).<br /> <br /> This was detected in production because it caused a continuous memory<br /> growth, eventually triggering kernel OOM and completely hard-locking<br /> the kernel.<br /> <br /> Relevant kmemleak stacktrace:<br /> <br /> unreferenced object 0xffff888131e69900 (size 128):<br /> comm "git", pid 66104, jiffies 4295435999<br /> hex dump (first 32 bytes):<br /> 76 6f 6c 75 6d 65 73 2f 63 6f 6e 74 61 69 6e 65 volumes/containe<br /> 72 73 2f 67 69 74 65 61 2f 67 69 74 65 61 2f 67 rs/gitea/gitea/g<br /> backtrace (crc 2f3bb450):<br /> [] __kmalloc_noprof+0x359/0x510<br /> [] ceph_mds_check_access+0x5bf/0x14e0 [ceph]<br /> [] ceph_open+0x312/0xd80 [ceph]<br /> [] do_dentry_open+0x456/0x1120<br /> [] vfs_open+0x79/0x360<br /> [] path_openat+0x1de5/0x4390<br /> [] do_filp_open+0x19c/0x3c0<br /> [] do_sys_openat2+0x141/0x180<br /> [] __x64_sys_open+0xe5/0x1a0<br /> [] do_syscall_64+0xb7/0x210<br /> [] entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> <br /> It can be triggered by mouting a subdirectory of a CephFS filesystem,<br /> and then trying to access files on this subdirectory with an auth token<br /> using a path-scoped capability:<br /> <br /> $ ceph auth get client.services<br /> [client.services]<br /> key = REDACTED<br /> caps mds = "allow rw fsname=cephfs path=/volumes/"<br /> caps mon = "allow r fsname=cephfs"<br /> caps osd = "allow rw tag cephfs data=cephfs"<br /> <br /> $ cat /proc/self/mounts<br /> services@[REDACTED].cephfs=/volumes/containers /ceph/containers ceph rw,noatime,name=services,secret=,ms_mode=prefer-crc,mount_timeout=300,acl,mon_addr=[REDACTED]:3300,recover_session=clean 0 0<br /> <br /> $ seq 1 1000000 | xargs -P32 --replace={} touch /ceph/containers/file-{} &amp;&amp; \<br /> seq 1 1000000 | xargs -P32 --replace={} cat /ceph/containers/file-{}<br /> <br /> [ idryomov: combine if statements, rename rc to path_matched and make<br /> it a bool, formatting ]