CVE-2025-39880

What it actually does

Generic messenger code in libceph reads and writes ceph_connection_v1_info union members without checking that msgr1 is active; on 64-bit systems this overlaps with v2 structures (auth_retry with out_iter, connect_seq with conn_bufs) causing invalid accesses or corruption.

Why it matters to the business

Linux systems using Ceph storage may experience intermittent connection instability or authorizer resets, though serious corruption is rare and not frequently triggered; kernel updates are required for long-term stability.

How an attack unfolds

An attacker with the ability to influence Ceph messenger state (typically local or via crafted cluster traffic) forces code paths that access the v1 union while msgr2 is active, resulting in reads of bogus values or writes that corrupt v2 connection state.

How to fix it

Update the Linux kernel to include commit ea12ab684f8ae8a6da11a22c78d94a79e2163096 which adds the required active-member checks before v1 union access.

How to confirm the fix worked

Confirm the running kernel source or binary contains commit ea12ab684f8ae8a6da11a22c78d94a79e2163096; exercise Ceph msgr1 and msgr2 connection paths under load and verify no invalid auth_retry or connect_seq values are observed.

Typical attack path

1. Establish or manipulate a Ceph connection using msgr2
2. Trigger generic messenger paths in messenger.c that assume v1 is active
3. Read or write overlapping union fields causing invalid auth state or connection buffer corruption

How to detect it

Inspect kernel and Ceph logs for repeated authorizer invalidation messages or connection sequence anomalies that coincide with msgr2 usage; correlate with process activity involving libceph or ceph kernel modules.

What your security team should do

• Prioritize kernel upgrade to the fixed commit in all Ceph-using distributions
• Review Ceph cluster logs for repeated authorizer invalidations after patching
• Test msgr1/msgr2 failover scenarios in staging before production rollout