CVE-2025-38660

What it actually does

Missing NUL termination on a string passed to strrchr() and related functions in ceph parse_longname() allows out-of-bounds memory access and potential kernel memory corruption.

Why it matters to the business

Systems using Ceph may experience kernel panics, service outages, or local privilege escalation when processing untrusted filesystem metadata; widespread Linux deployments increase operational risk even with modest exploit probability.

How an attack unfolds

An attacker supplies a crafted Ceph longname entry lacking a trailing NUL byte; the vulnerable parse_longname path calls strrchr() on the non-terminated buffer, resulting in linear overread, possible kstrtou64 misuse, and memory corruption that can be chained for code execution or denial of service. Groups such as VMSCAPE have targeted similar Linux kernel container escape primitives.

How to fix it

Update the Linux kernel to commit bb80f7618832d26f7e395f52f82b1dac76223e5f or later; for Chainguard packages apply openjdk-11-openj9 0.53.0-r0 or newer that incorporate the corrected kernel.

How to confirm the fix worked

Confirm the running kernel contains commit bb80f7618832d26f7e395f52f82b1dac76223e5f; recompile or reload Ceph modules and verify that directory listings with longnames no longer trigger faults under fuzzing.

Typical attack path

1. Obtain write access to a Ceph RADOS or filesystem image presented to the target kernel
2. Craft a directory entry whose longname payload omits the terminating NUL
3. Trigger parse_longname() via directory enumeration, mount, or metadata readdir
4. Leverage resulting memory corruption to corrupt kernel structures or achieve code execution
5. Escalate to container breakout or host compromise

How to detect it

Review kernel logs for Ceph-related oops or warnings during directory operations; inspect auditd or syscall traces for unexpected strrchr or kmemdup activity on Ceph metadata; correlate with container runtime logs for privilege-escalation attempts by listed threat actors.

What your security team should do

• Prioritize kernel upgrades on any host mounting Ceph volumes within the next patch cycle
• Harden container runtime configurations to reduce attack surface for kernel exploits
• Monitor EPSS trend and threat actor activity for similar container-escape CVEs
• Apply fixed Chainguard package versions where OpenJDK images embed vulnerable kernels