CephFS kernel client (ceph.ko, MDS auth caps): In a multi-FS Ceph cluster the kernel client applies an MDS auth cap

Impact

In a multi-FS Ceph cluster the kernel client applies an MDS auth cap from one file system to another because it never compares fsname. A key granted read-only on fsname1 and read-write on fsname2 ends up with write rights on fsname1 - so a tenant scoped to their own file system can write into another one.

Who can reach it

Any user on a compute node that kernel-mounts CephFS in a cluster running more than one file system, using a CephX key with differing caps per file system.

What to do

Update the kernel on all CephFS client nodes to one carrying the multifs auth-caps fix, drain and reboot each node. Until then avoid granting one CephX principal different caps across file systems in the same cluster - use a distinct key per file system.

References

Related entries

• libssh: failed key derivation returns success, leaving SSH sessions keyed with uninitialized memoryCVE-2025-5372 · libssh (ssh_kdf key derivation, builds against OpenSSL older than 3.0)High
• AMD Pensando ionic cloud driver for VMware ESXi (heap overflow): Second heap overflow in the ionic ESXi driverCVE-2025-62623 · AMD Pensando ionic cloud driver for VMware ESXi (heap overflow)High
• AMD Pensando ionic cloud driver for VMware ESXi (heap overflow): Heap-based buffer overflow in the ionic SmartNICCVE-2025-62624 · AMD Pensando ionic cloud driver for VMware ESXi (heap overflow)High
• Linux kernel (drivers/iommu): This is the substantive fix for stale IOMMU translations of the kernel address spaceCVE-2025-71202 · Linux kernel (drivers/iommu)High
• KubeVirt virt-handler (symlink following in migration proxy): During live migration virt-handler dials Unix socketsCVE-2026-13622 · KubeVirt virt-handler (symlink following in migration proxy)High
• SSSD LDAP sudo provider: unscoped sudoRole search lets any LDAP writer grant themselves root fleet-wideCVE-2026-14474 · SSSD LDAP sudo provider (ldap_sudo_search_base unset)High