Linux kernel libceph: messenger reads and writes the v1 union member while msgr2 is in use, corrupting connection state

Impact

Generic code in the kernel Ceph messenger touches con->v1 without checking that msgr1 is the active union member. On 64-bit hosts con->v1.auth_retry overlaps con->v2.out_iter, so the read returns garbage and the client needlessly invalidates its authorizer and refetches tickets; worse, con->v1.connect_seq overlaps con->v2.conn_bufs, and writing it corrupts msgr2 connection buffers. The upstream note says the damaging write is rare in practice. For operators this is a stability and state-corruption bug in the in-kernel RBD and CephFS client that GPU nodes use to mount training datasets and checkpoints over msgr2 - the failure shows up as dropped sessions or worse against the storage cluster, affecting every job on the node, not as a tenant-reachable privilege path.

Who can reach it

No tenant or network authentication path is described. Reached in normal operation of the in-kernel Ceph client when msgr2 is in use; the triggering conditions are connection-state transitions against the Ceph cluster, not attacker-supplied input.

What to do

Take the stable kernel update that gates the union accesses on the active messenger version (five backports linked). Rollout is drain and reboot on each node that mounts CephFS or maps RBD images in-kernel; userspace librbd/libcephfs clients are not affected and need no action. No configuration workaround is given in the record.

References

Related entries

• Linux kernel FUSE: slab out-of-bounds write in fuse_dev_do_write when the retrieve length is truncatedCVE-2025-39888 · Linux kernel FUSE (fuse_dev_do_write, folio limit check)High
• Linux kernel i40e: wrong dev_id in free_irq() leaves IRQs un-freed on the MSI-X error pathCVE-2025-39911 · Linux kernel i40e driver (Intel X710/XL710 MSI-X IRQ request error path)High
• Linux kernel BPF: missing destination length check in bpf_crypto_crypt allows out-of-bounds writeCVE-2025-39917 · Linux kernel BPF (bpf_crypto_crypt dynptr length check)High
• Linux kernel io_uring: io_link_skb compares a notification against itself, skipping the context validation checkCVE-2025-39963 · Linux kernel io_uring zero-copy send (io_link_skb notification context check)High
• Linux kernel (net/xfrm): SPI 0 means 'no SPI assigned', but the duplicate-SPI rework started creating states with SPI 0CVE-2025-39965 · Linux kernel (net/xfrm)High
• Linux kernel (drivers/iommu/iommufd): Aborting an iommufd object allocation freed the object immediately while theCVE-2025-39966 · Linux kernel (drivers/iommu/iommufd)High