CVE-2025-40362 (GCVE-0-2025-40362)

Vulnerability from cvelistv5 – Published: 2025-12-16 13:40 – Updated: 2026-10-15 22:02
VLAI
Title
ceph: fix multifs mds auth caps issue
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: fix multifs mds auth caps issue The mds auth caps check should also validate the fsname along with the associated caps. Not doing so would result in applying the mds auth caps of one fs on to the other fs in a multifs ceph cluster. The bug causes multiple issues w.r.t user authentication, following is one such example. Steps to Reproduce (on vstart cluster): 1. Create two file systems in a cluster, say 'fsname1' and 'fsname2' 2. Authorize read only permission to the user 'client.usr' on fs 'fsname1' $ceph fs authorize fsname1 client.usr / r 3. Authorize read and write permission to the same user 'client.usr' on fs 'fsname2' $ceph fs authorize fsname2 client.usr / rw 4. Update the keyring $ceph auth get client.usr >> ./keyring With above permssions for the user 'client.usr', following is the expectation. a. The 'client.usr' should be able to only read the contents and not allowed to create or delete files on file system 'fsname1'. b. The 'client.usr' should be able to read/write on file system 'fsname2'. But, with this bug, the 'client.usr' is allowed to read/write on file system 'fsname1'. See below. 5. Mount the file system 'fsname1' with the user 'client.usr' $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/ 6. Try creating a file on file system 'fsname1' with user 'client.usr'. This should fail but passes with this bug. $touch /kmnt_fsname1_usr/file1 7. Mount the file system 'fsname1' with the user 'client.admin' and create a file. $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin $echo "data" > /kmnt_fsname1_admin/admin_file1 8. Try removing an existing file on file system 'fsname1' with the user 'client.usr'. This shoudn't succeed but succeeds with the bug. $rm -f /kmnt_fsname1_usr/admin_file1 For more information, please take a look at the corresponding mds/fuse patch and tests added by looking into the tracker mentioned below. v2: Fix a possible null dereference in doutc v3: Don't store fsname from mdsmap, validate against ceph_mount_options's fsname and use it v4: Code refactor, better warning message and fix possible compiler warning [ Slava.Dubeyko: "fsname check failed" -> "fsname mismatch" ]
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 21:59 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6820 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 596afb0b8933ba6ed7227adcc538db26feb25c74 , < 07640d34a781bb2e39020a39137073c03c4aa932 (git)
Affected: 596afb0b8933ba6ed7227adcc538db26feb25c74 , < ca3da8b27ab9a0923ad477447cfb8fc7f4b4c523 (git)
Affected: 596afb0b8933ba6ed7227adcc538db26feb25c74 , < 22c73d52a6d05c5a2053385c0d6cd9984732799d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.12.58 , ≤ 6.12.* (semver)
Unaffected: 6.17.8 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-40362",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:59:40.317622Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T22:02:46.619Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/mds_client.c",
            "fs/ceph/mdsmap.c",
            "fs/ceph/super.c",
            "fs/ceph/super.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "07640d34a781bb2e39020a39137073c03c4aa932",
              "status": "affected",
              "version": "596afb0b8933ba6ed7227adcc538db26feb25c74",
              "versionType": "git"
            },
            {
              "lessThan": "ca3da8b27ab9a0923ad477447cfb8fc7f4b4c523",
              "status": "affected",
              "version": "596afb0b8933ba6ed7227adcc538db26feb25c74",
              "versionType": "git"
            },
            {
              "lessThan": "22c73d52a6d05c5a2053385c0d6cd9984732799d",
              "status": "affected",
              "version": "596afb0b8933ba6ed7227adcc538db26feb25c74",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/mds_client.c",
            "fs/ceph/mdsmap.c",
            "fs/ceph/super.c",
            "fs/ceph/super.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix multifs mds auth caps issue\n\nThe mds auth caps check should also validate the\nfsname along with the associated caps. Not doing\nso would result in applying the mds auth caps of\none fs on to the other fs in a multifs ceph cluster.\nThe bug causes multiple issues w.r.t user\nauthentication, following is one such example.\n\nSteps to Reproduce (on vstart cluster):\n1. Create two file systems in a cluster, say \u0027fsname1\u0027 and \u0027fsname2\u0027\n2. Authorize read only permission to the user \u0027client.usr\u0027 on fs \u0027fsname1\u0027\n    $ceph fs authorize fsname1 client.usr / r\n3. Authorize read and write permission to the same user \u0027client.usr\u0027 on fs \u0027fsname2\u0027\n    $ceph fs authorize fsname2 client.usr / rw\n4. Update the keyring\n    $ceph auth get client.usr \u003e\u003e ./keyring\n\nWith above permssions for the user \u0027client.usr\u0027, following is the\nexpectation.\n  a. The \u0027client.usr\u0027 should be able to only read the contents\n     and not allowed to create or delete files on file system \u0027fsname1\u0027.\n  b. The \u0027client.usr\u0027 should be able to read/write on file system \u0027fsname2\u0027.\n\nBut, with this bug, the \u0027client.usr\u0027 is allowed to read/write on file\nsystem \u0027fsname1\u0027. See below.\n\n5. Mount the file system \u0027fsname1\u0027 with the user \u0027client.usr\u0027\n     $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/\n6. Try creating a file on file system \u0027fsname1\u0027 with user \u0027client.usr\u0027. This\n   should fail but passes with this bug.\n     $touch /kmnt_fsname1_usr/file1\n7. Mount the file system \u0027fsname1\u0027 with the user \u0027client.admin\u0027 and create a\n   file.\n     $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin\n     $echo \"data\" \u003e /kmnt_fsname1_admin/admin_file1\n8. Try removing an existing file on file system \u0027fsname1\u0027 with the user\n   \u0027client.usr\u0027. This shoudn\u0027t succeed but succeeds with the bug.\n     $rm -f /kmnt_fsname1_usr/admin_file1\n\nFor more information, please take a look at the corresponding mds/fuse patch\nand tests added by looking into the tracker mentioned below.\n\nv2: Fix a possible null dereference in doutc\nv3: Don\u0027t store fsname from mdsmap, validate against\n    ceph_mount_options\u0027s fsname and use it\nv4: Code refactor, better warning message and\n    fix possible compiler warning\n\n[ Slava.Dubeyko: \"fsname check failed\" -\u003e \"fsname mismatch\" ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The broken check is reached through ordinary local syscalls (`open`, `openat(O_CREAT)`, `unlink`, `rmdir`, `setattr`) on an already-mounted CephFS; the attacker acts on the client host, not over the wire.\nAC:L - No race, no memory-layout dependency \u2014 the attacker simply performs the file operation and the mismatched cap entry is applied deterministically; the multi-filesystem/`ceph fs authorize` configuration is a standard supported multi-tenant CephFS deployment.\nPR:L - Any unprivileged local user with access to the CephFS mount can trigger it; no capability, no user-namespace trick, and no cluster-side privilege is needed because the mount\u0027s cephx key is shared by all local users.\nUI:N - Exploitation requires no action by any other user or administrator beyond the mount already existing; the attacker\u0027s own file operations are sufficient.\nS:C - The kernel client enforces the Ceph cluster\u0027s cephx MDS auth policy on the cluster\u0027s behalf (the MDS delegates async-dirop authorization to it via CEPHFS_FEATURE_MDS_AUTH_CAPS_CHECK), so the bypass grants access to data in a different filesystem/tenant governed by the Ceph cluster\u0027s separate security authority.\nC:H - A cap entry belonging to another filesystem (e.g. `allow rw fsname=fs2 path=/`) is applied to the mounted filesystem, defeating `path=` and uid/gid read restrictions and exposing the contents of files the key was never authorized to read.\nI:H - The commit\u0027s reproducer shows a read-only-authorized user creating files and deleting an admin-written file on the restricted filesystem; root_squash and writeable=false restrictions are both defeated, giving unauthorized write over the tree.\nA:H - The same bypass permits unlink/rmdir and overwrite of other tenants\u0027 data on shared cluster storage, destroying data that legitimate users depend on."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:54.515Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/07640d34a781bb2e39020a39137073c03c4aa932"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca3da8b27ab9a0923ad477447cfb8fc7f4b4c523"
        },
        {
          "url": "https://git.kernel.org/stable/c/22c73d52a6d05c5a2053385c0d6cd9984732799d"
        }
      ],
      "title": "ceph: fix multifs mds auth caps issue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40362",
    "datePublished": "2025-12-16T13:40:02.467Z",
    "dateReserved": "2025-04-16T07:20:57.187Z",
    "dateUpdated": "2026-10-15T22:02:46.619Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40362",
      "date": "2026-11-02",
      "epss": "0.00163",
      "percentile": "0.05527"
    },
    "microsoft_vex": {
      "current_release_date": "2025-12-17T01:02:26.000Z",
      "cve": "CVE-2025-40362",
      "id": "msrc_CVE-2025-40362",
      "initial_release_date": "2025-12-02T00:00:00.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ceph: fix multifs mds auth caps issue",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40362.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ceph/mds_client.c",
                  "fs/ceph/mdsmap.c",
                  "fs/ceph/super.c",
                  "fs/ceph/super.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "07640d34a781bb2e39020a39137073c03c4aa932",
                    "status": "affected",
                    "version": "596afb0b8933ba6ed7227adcc538db26feb25c74",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ca3da8b27ab9a0923ad477447cfb8fc7f4b4c523",
                    "status": "affected",
                    "version": "596afb0b8933ba6ed7227adcc538db26feb25c74",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "22c73d52a6d05c5a2053385c0d6cd9984732799d",
                    "status": "affected",
                    "version": "596afb0b8933ba6ed7227adcc538db26feb25c74",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ceph/mds_client.c",
                  "fs/ceph/mdsmap.c",
                  "fs/ceph/super.c",
                  "fs/ceph/super.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.10"
                  },
                  {
                    "lessThan": "6.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.58",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix multifs mds auth caps issue\n\nThe mds auth caps check should also validate the\nfsname along with the associated caps. Not doing\nso would result in applying the mds auth caps of\none fs on to the other fs in a multifs ceph cluster.\nThe bug causes multiple issues w.r.t user\nauthentication, following is one such example.\n\nSteps to Reproduce (on vstart cluster):\n1. Create two file systems in a cluster, say \u0027fsname1\u0027 and \u0027fsname2\u0027\n2. Authorize read only permission to the user \u0027client.usr\u0027 on fs \u0027fsname1\u0027\n    $ceph fs authorize fsname1 client.usr / r\n3. Authorize read and write permission to the same user \u0027client.usr\u0027 on fs \u0027fsname2\u0027\n    $ceph fs authorize fsname2 client.usr / rw\n4. Update the keyring\n    $ceph auth get client.usr \u003e\u003e ./keyring\n\nWith above permssions for the user \u0027client.usr\u0027, following is the\nexpectation.\n  a. The \u0027client.usr\u0027 should be able to only read the contents\n     and not allowed to create or delete files on file system \u0027fsname1\u0027.\n  b. The \u0027client.usr\u0027 should be able to read/write on file system \u0027fsname2\u0027.\n\nBut, with this bug, the \u0027client.usr\u0027 is allowed to read/write on file\nsystem \u0027fsname1\u0027. See below.\n\n5. Mount the file system \u0027fsname1\u0027 with the user \u0027client.usr\u0027\n     $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/\n6. Try creating a file on file system \u0027fsname1\u0027 with user \u0027client.usr\u0027. This\n   should fail but passes with this bug.\n     $touch /kmnt_fsname1_usr/file1\n7. Mount the file system \u0027fsname1\u0027 with the user \u0027client.admin\u0027 and create a\n   file.\n     $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin\n     $echo \"data\" \u003e /kmnt_fsname1_admin/admin_file1\n8. Try removing an existing file on file system \u0027fsname1\u0027 with the user\n   \u0027client.usr\u0027. This shoudn\u0027t succeed but succeeds with the bug.\n     $rm -f /kmnt_fsname1_usr/admin_file1\n\nFor more information, please take a look at the corresponding mds/fuse patch\nand tests added by looking into the tracker mentioned below.\n\nv2: Fix a possible null dereference in doutc\nv3: Don\u0027t store fsname from mdsmap, validate against\n    ceph_mount_options\u0027s fsname and use it\nv4: Code refactor, better warning message and\n    fix possible compiler warning\n\n[ Slava.Dubeyko: \"fsname check failed\" -\u003e \"fsname mismatch\" ]"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nceph: corrige problema de capacidades de autenticaci\u00f3n mds multifs\n\nLa verificaci\u00f3n de capacidades de autenticaci\u00f3n mds tambi\u00e9n deber\u00eda validar el fsname junto con las capacidades asociadas. No hacerlo resultar\u00eda en la aplicaci\u00f3n de las capacidades de autenticaci\u00f3n mds de un fs en el otro fs en un cl\u00faster ceph multifs. El error causa m\u00faltiples problemas con respecto a la autenticaci\u00f3n de usuario, el siguiente es un ejemplo.\n\nPasos para Reproducir (en cl\u00faster vstart):\n1. Cree dos sistemas de archivos en un cl\u00faster, por ejemplo \u0027fsname1\u0027 y \u0027fsname2\u0027\n2. Autorice permiso de solo lectura al usuario \u0027client.usr\u0027 en el fs \u0027fsname1\u0027\n    $ceph fs authorize fsname1 client.usr / r\n3. Autorice permiso de lectura y escritura al mismo usuario \u0027client.usr\u0027 en el fs \u0027fsname2\u0027\n    $ceph fs authorize fsname2 client.usr / rw\n4. Actualice el keyring\n    $ceph auth get client.usr \u003e\u003e ./keyring\n\nCon los permisos anteriores para el usuario \u0027client.usr\u0027, la siguiente es la expectativa.\n  a. El \u0027client.usr\u0027 deber\u00eda poder solo leer los contenidos y no tener permitido crear o eliminar archivos en el sistema de archivos \u0027fsname1\u0027.\n  b. El \u0027client.usr\u0027 deber\u00eda poder leer/escribir en el sistema de archivos \u0027fsname2\u0027.\n\nPero, con este error, al \u0027client.usr\u0027 se le permite leer/escribir en el sistema de archivos \u0027fsname1\u0027. Vea a continuaci\u00f3n.\n\n5. Monte el sistema de archivos \u0027fsname1\u0027 con el usuario \u0027client.usr\u0027\n     $sudo bin/mount.ceph usr@.fsname1=/ /kmnt_fsname1_usr/\n6. Intente crear un archivo en el sistema de archivos \u0027fsname1\u0027 con el usuario \u0027client.usr\u0027. Esto deber\u00eda fallar pero pasa con este error.\n     $touch /kmnt_fsname1_usr/file1\n7. Monte el sistema de archivos \u0027fsname1\u0027 con el usuario \u0027client.admin\u0027 y cree un archivo.\n     $sudo bin/mount.ceph admin@.fsname1=/ /kmnt_fsname1_admin\n     $echo \u201cdata\u201d \u003e /kmnt_fsname1_admin/admin_file1\n8. Intente eliminar un archivo existente en el sistema de archivos \u0027fsname1\u0027 con el usuario \u0027client.usr\u0027. Esto no deber\u00eda tener \u00e9xito pero tiene \u00e9xito con el error.\n     $rm -f /kmnt_fsname1_usr/admin_file1\n\nPara m\u00e1s informaci\u00f3n, por favor, eche un vistazo al parche mds/fuse correspondiente y las pruebas a\u00f1adidas consultando el rastreador mencionado a continuaci\u00f3n.\n\nv2: Corrige una posible desreferencia nula en doutc\nv3: No almacene fsname de mdsmap, valide contra el fsname de ceph_mount_options y \u00faselo\nv4: Refactorizaci\u00f3n de c\u00f3digo, mejor mensaje de advertencia y corrige posible advertencia del compilador\n\n[ Slava.Dubeyko: \u0027fsname check failed\u0027  -\u003e  \u0027fsname mismatch\u0027 ]"
          }
        ],
        "id": "CVE-2025-40362",
        "lastModified": "2026-10-15T22:19:09.207",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-40362",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:59:40.317622Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-16T14:15:48.217",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/07640d34a781bb2e39020a39137073c03c4aa932"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/22c73d52a6d05c5a2053385c0d6cd9984732799d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ca3da8b27ab9a0923ad477447cfb8fc7f4b4c523"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-16T23:16:50+00:00",
      "cve": "CVE-2025-40362",
      "id": "CVE-2025-40362",
      "initial_release_date": "2025-12-16T00:00:00+00:00",
      "product_status:known_affected": "261",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel (ceph): Incorrect authorization allows privilege escalation in multifs clusters",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40362.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.