Race Condition Vulnerability in Linux Kernel: Impacting Ceph Directory Operations
Summary
DEBIAN-CVE-2025-39927: In the Linux kernel, the following vulnerability has been resolved: ceph: fix race condition validating r_parent before applying state Add validation to ensure the cached parent directory inode matches the directory info... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, managing hardware and system resources. It provides essential services for all other software running on the system. The kernel is known for its stability, performance, and security features. However, vulnerabilities can arise, such as the one affecting the Ceph file system, which is designed for distributed storage. This specific vulnerability can lead to race conditions during directory operations, potentially compromising data integrity.
Vulnerability Detail
In the Linux kernel, a race condition was identified in the Ceph file system, specifically when validating the r_parent directory inode before applying state changes. This flaw allows concurrent operations, like renaming directories, to lead to stale references, resulting in incorrect state changes being applied to directory inodes. The vulnerability can cause reference leaks and underflows, impacting the reliability of the file system and potentially leading to data loss or corruption.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patch as soon as it is available to avoid potential risks.
Conclusion
The identified race condition vulnerability in the Linux kernel's Ceph file system poses significant risks to data integrity during directory operations. Users are strongly encouraged to apply the available patches to safeguard their systems. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a race condition in the Ceph file system of the Linux kernel, which can lead to incorrect state changes in directory operations.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If exploited, this vulnerability can lead to data integrity issues, including reference leaks and potential data loss in the Ceph file system.
Yes, patches are available for various Debian versions. Users should update to at least version 6.12.48-1 for Debian 13 or 6.16.8-1 for Debian 14.
You can use Vulert to receive real-time alerts for open-source vulnerabilities in your software, ensuring you are always informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
