Kernel Vulnerability in Linux Package: Ceph Encryption Handling Issue
Summary
DEBIAN-CVE-2025-38223: In the Linux kernel, the following vulnerability has been resolved: ceph: avoid kernel BUG for encrypted inode with unaligned file size The generic/397 test hits a BUG_ON for the case of encrypted inode with unaligned fi... Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system, responsible for managing hardware resources and providing essential services to applications. It supports various file systems, networking, and security features. This specific vulnerability affects the Ceph file system, which is designed for distributed storage and is widely used in cloud computing environments. The vulnerability arises from improper handling of encrypted inodes with unaligned file sizes, potentially leading to kernel crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the Ceph file system that can trigger a kernel BUG when handling encrypted inodes with unaligned file sizes (e.g., 33K or 1K). This issue can lead to system instability, crashes, and potential data loss. The vulnerability is rooted in the way the kernel processes messages related to Ceph, where certain conditions can cause an invalid opcode error, resulting in a kernel panic. The specific code path that leads to this issue is found in the net/ceph/messenger.c file.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using encrypted inodes with unaligned file sizes until the patch is applied. This may involve reconfiguring applications that utilize the Ceph file system to ensure proper file size alignment.
Conclusion
The identified vulnerability in the Linux kernel related to the Ceph file system poses significant risks, including system crashes and potential data loss. It is crucial for users to update to the patched version to mitigate these risks. Implementing workarounds can provide temporary relief, but the best course of action is to apply the necessary updates promptly.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to kernel crashes and system instability, affecting the reliability of applications relying on the Ceph file system.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any installation.
Yes, due to potential kernel crashes, there is a risk of data loss if the vulnerability is exploited.
If an immediate update is not possible, consider implementing the suggested workaround by avoiding the use of unaligned file sizes with encrypted inodes.
Detailed information can be found in the official Debian CVE database or by consulting the Linux kernel documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
