Memory Leak Vulnerability in Linux Kernel: Ceph Package Affected
Summary
DEBIAN-CVE-2025-21737: In the Linux kernel, the following vulnerability has been resolved: ceph: fix memory leak in ceph_mds_auth_match() We now free the temporary target path substring allocation on every possible branch, instead of omitting... Affects linux versions < 6.12.15-1. Fixed in 6.12.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, managing hardware resources and providing essential services for software applications. It supports a wide range of functionalities, including process management, memory management, and file systems. The Ceph package is a distributed storage system that integrates with the Linux kernel, allowing for scalable and fault-tolerant storage solutions. This vulnerability specifically affects the Ceph file system, which can lead to significant system instability if not addressed.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the Ceph file system related to memory management. The issue arises in the ceph_mds_auth_match() function, where a memory leak occurs due to improper handling of temporary target path substring allocations. This can lead to continuous memory growth, eventually triggering the kernel's Out Of Memory (OOM) killer, which can cause the system to hard-lock. The vulnerability can be exploited by accessing files in a subdirectory of a CephFS filesystem with an authentication token, leading to potential system crashes.
How To Fix
Minimum fixed version
6.12.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the Ceph file system or avoid mounting subdirectories until the patch is applied. Additionally, monitoring memory usage closely can help identify potential issues before they lead to system crashes.
Conclusion
The identified memory leak vulnerability in the Ceph file system of the Linux kernel poses a significant risk to system stability. It is essential for users to update their Linux packages to the patched version 6.12.15-1 to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a memory leak in the Ceph file system within the Linux kernel, which can lead to system crashes due to excessive memory consumption.
You can use the Vulert platform to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to monitor for open-source vulnerabilities.
Failure to address this vulnerability can result in system instability, crashes, and potential data loss due to the kernel's OOM killer being triggered.
Yes, the vulnerability is fixed in the Linux package version 6.12.15-1. It is crucial to update to this version or later.
Yes, you can use the Vulert playground to check for vulnerabilities without requiring any signup. Visit Vulert Scanner to get started.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
