CVE-2025-38660 (GCVE-0-2025-38660)
Vulnerability from cvelistv5 – Published: 2025-08-22 16:01 – Updated: 2026-10-15 22:02
VLAI
EPSS
VEX
Title
[ceph] parse_longname(): strrchr() expects NUL-terminated string
Summary
In the Linux kernel, the following vulnerability has been resolved:
[ceph] parse_longname(): strrchr() expects NUL-terminated string
... and parse_longname() is not guaranteed that. That's the reason
why it uses kmemdup_nul() to build the argument for kstrtou64();
the problem is, kstrtou64() is not the only thing that need it.
Just get a NUL-terminated copy of the entire thing and be done
with that...
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 21:52 UTC
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
dd66df0053ef84add5e684df517aa9b498342381 , < 4b9aee707c4580511983a0998547f3b28514e6a6
(git)
Affected: dd66df0053ef84add5e684df517aa9b498342381 , < bb80f7618832d26f7e395f52f82b1dac76223e5f (git) Affected: dd66df0053ef84add5e684df517aa9b498342381 , < 3145b2b11492d61c512bbc59660bb823bc757f48 (git) Affected: dd66df0053ef84add5e684df517aa9b498342381 , < 493479af8af3ab907f49e99323777d498a4fbd2b (git) Affected: dd66df0053ef84add5e684df517aa9b498342381 , < 101841c38346f4ca41dc1802c867da990ffb32eb (git) |
guessed | |
| Linux | Linux |
Affected:
6.6
Unaffected: 0 , < 6.6 (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.42 , ≤ 6.12.* (semver) Unaffected: 6.15.10 , ≤ 6.15.* (semver) Unaffected: 6.16.1 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-38660",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T21:52:41.406590Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T22:02:27.813Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ceph/crypto.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4b9aee707c4580511983a0998547f3b28514e6a6",
"status": "affected",
"version": "dd66df0053ef84add5e684df517aa9b498342381",
"versionType": "git"
},
{
"lessThan": "bb80f7618832d26f7e395f52f82b1dac76223e5f",
"status": "affected",
"version": "dd66df0053ef84add5e684df517aa9b498342381",
"versionType": "git"
},
{
"lessThan": "3145b2b11492d61c512bbc59660bb823bc757f48",
"status": "affected",
"version": "dd66df0053ef84add5e684df517aa9b498342381",
"versionType": "git"
},
{
"lessThan": "493479af8af3ab907f49e99323777d498a4fbd2b",
"status": "affected",
"version": "dd66df0053ef84add5e684df517aa9b498342381",
"versionType": "git"
},
{
"lessThan": "101841c38346f4ca41dc1802c867da990ffb32eb",
"status": "affected",
"version": "dd66df0053ef84add5e684df517aa9b498342381",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ceph/crypto.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.42",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.10",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.1",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\n[ceph] parse_longname(): strrchr() expects NUL-terminated string\n\n... and parse_longname() is not guaranteed that. That\u0027s the reason\nwhy it uses kmemdup_nul() to build the argument for kstrtou64();\nthe problem is, kstrtou64() is not the only thing that need it.\n\nJust get a NUL-terminated copy of the entire thing and be done\nwith that..."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The unterminated string is dentry-name data read directly out of a Ceph MDS reply message (`info-\u003edname = *p`, `_name = *p`) sitting in the kvmalloc\u0027d `msg-\u003efront` buffer, so a malicious/compromised MDS or an on-path attacker on unencrypted cephfs traffic supplies it remotely. No local caller can produce a non-NUL-terminated name.\nAC:L - The attacker fully controls the reply contents and the exact `front_len`, so they can place the name flush against the end of the allocation and make the overread deterministic; the only build requirement is `CONFIG_FS_ENCRYPTION=y`, which is standard in distro and Android kernels, and no encryption key or encrypted directory is needed since `parse_longname()` runs before those checks.\nPR:N - The attacker holds no account or privilege on the victim client \u2014 the malicious reply is processed by the messenger/MDS-client code with no authorization check on the client side. Any process\u0027s routine directory access on the already-established mount suffices to consume it.\nUI:N - The snapdir condition depends on the server-supplied `snapid`, so a hostile MDS can mark an ordinary directory as `CEPH_SNAPDIR` and trigger the path on any normal readdir or lookup \u2014 no deliberate `.snap` access, remount, or other victim action is required.\nS:U - The out-of-bounds access is confined to kernel memory within the same security authority as the ceph client; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `strrchr()` reads unbounded adjacent kernel heap until it finds a NUL, and the resulting inflated `*name_len` causes those out-of-bounds bytes to be base64-decoded and propagated into the dentry name handed back toward userspace, giving an unbounded kernel memory disclosure primitive.\nI:H - The corrupted `*name_len` is no longer bounded by the `NAME_MAX` check (which was applied to the pre-parse copy), so `ceph_base64_decode()` and `fscrypt_fname_disk_to_usr()` write far past the end of the `NAME_MAX` fscrypt buffer or the message front buffer, yielding a heap out-of-bounds write with attacker-influenced data.\nA:H - The overread walks off a kvmalloc allocation and can hit a vmalloc guard page or unmapped memory, and the derived oversized length drives a heap overflow \u2014 either produces an oops/panic in the ceph messenger work context, and the attacker can repeat it on every reply."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T11:58:04.340Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4b9aee707c4580511983a0998547f3b28514e6a6"
},
{
"url": "https://git.kernel.org/stable/c/bb80f7618832d26f7e395f52f82b1dac76223e5f"
},
{
"url": "https://git.kernel.org/stable/c/3145b2b11492d61c512bbc59660bb823bc757f48"
},
{
"url": "https://git.kernel.org/stable/c/493479af8af3ab907f49e99323777d498a4fbd2b"
},
{
"url": "https://git.kernel.org/stable/c/101841c38346f4ca41dc1802c867da990ffb32eb"
}
],
"title": "[ceph] parse_longname(): strrchr() expects NUL-terminated string",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38660",
"datePublished": "2025-08-22T16:01:03.686Z",
"dateReserved": "2025-04-16T04:51:24.031Z",
"dateUpdated": "2026-10-15T22:02:27.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-38660",
"date": "2026-10-31",
"epss": "0.00405",
"percentile": "0.34743"
},
"microsoft_vex": {
"current_release_date": "2026-09-24T02:32:19.000Z",
"cve": "CVE-2025-38660",
"id": "msrc_CVE-2025-38660",
"initial_release_date": "2025-09-03T22:14:03.000Z",
"product_status:known_affected": "21",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "[ceph] parse_longname(): strrchr() expects NUL-terminated string",
"url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38660.json",
"version": "21"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ceph/crypto.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4b9aee707c4580511983a0998547f3b28514e6a6",
"status": "affected",
"version": "dd66df0053ef84add5e684df517aa9b498342381",
"versionType": "git"
},
{
"lessThan": "bb80f7618832d26f7e395f52f82b1dac76223e5f",
"status": "affected",
"version": "dd66df0053ef84add5e684df517aa9b498342381",
"versionType": "git"
},
{
"lessThan": "3145b2b11492d61c512bbc59660bb823bc757f48",
"status": "affected",
"version": "dd66df0053ef84add5e684df517aa9b498342381",
"versionType": "git"
},
{
"lessThan": "493479af8af3ab907f49e99323777d498a4fbd2b",
"status": "affected",
"version": "dd66df0053ef84add5e684df517aa9b498342381",
"versionType": "git"
},
{
"lessThan": "101841c38346f4ca41dc1802c867da990ffb32eb",
"status": "affected",
"version": "dd66df0053ef84add5e684df517aa9b498342381",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ceph/crypto.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2081142E-1E36-42C9-9F17-D17DFF7B026B",
"versionEndExcluding": "6.12.42",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5890C690-B295-40C2-9121-FF5F987E5142",
"versionEndExcluding": "6.15.10",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "58182352-D7DF-4CC9-841E-03C1D852C3FB",
"versionEndExcluding": "6.16.1",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\n[ceph] parse_longname(): strrchr() expects NUL-terminated string\n\n... and parse_longname() is not guaranteed that. That\u0027s the reason\nwhy it uses kmemdup_nul() to build the argument for kstrtou64();\nthe problem is, kstrtou64() is not the only thing that need it.\n\nJust get a NUL-terminated copy of the entire thing and be done\nwith that..."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: [ceph] parse_longname(): strrchr() espera una cadena terminada en NUL... y parse_longname() no lo garantiza. Por eso usa kmemdup_nul() para construir el argumento de kstrtou64(); el problema es que kstrtou64() no es el \u00fanico que lo necesita. Simplemente obtenga una copia terminada en NUL de todo el conjunto y listo."
}
],
"id": "CVE-2025-38660",
"lastModified": "2026-10-15T22:18:48.640",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-38660",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T21:52:41.406590Z",
"version": "2.0.3"
}
}
]
},
"published": "2025-08-22T16:15:41.193",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/101841c38346f4ca41dc1802c867da990ffb32eb"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/3145b2b11492d61c512bbc59660bb823bc757f48"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/493479af8af3ab907f49e99323777d498a4fbd2b"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/4b9aee707c4580511983a0998547f3b28514e6a6"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/bb80f7618832d26f7e395f52f82b1dac76223e5f"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-07-30T09:02:25+00:00",
"cve": "CVE-2025-38660",
"id": "CVE-2025-38660",
"initial_release_date": "2025-08-22T00:00:00+00:00",
"product_status:known_affected": "184",
"product_status:known_not_affected": "90",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: [ceph] parse_longname(): strrchr() expects NUL-terminated string",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38660.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.