by Kastro
Paper/Archive/CVE-2025-38660

CVE-2025-38660

Linux Linux — [ceph] parse_longname(): strrchr() expects NUL-terminated string

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 34.7.347 × 206.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: [ceph] parse_longname(): strrchr() expects NUL-terminated string ... and parse_longname() is not guaranteed that. That's the reason why it uses kmemdup_nul() to build the argument for kstrtou64(); the problem is, kstrtou64() is not the only thing that need it. Just get a NUL-terminated copy of the entire thing and be done with that...

Affected

ProductAffectedFixed inSource
Linuxdd66df0053ef84add5e684df517aa9b498342381 – < 4b9aee707c4580511983a0998547f3b28514e6a64b9aee707c4580511983a0998547f3b28514e6a6CNA
Linuxdd66df0053ef84add5e684df517aa9b498342381 – < bb80f7618832d26f7e395f52f82b1dac76223e5fbb80f7618832d26f7e395f52f82b1dac76223e5fCNA
Linuxdd66df0053ef84add5e684df517aa9b498342381 – < 3145b2b11492d61c512bbc59660bb823bc757f483145b2b11492d61c512bbc59660bb823bc757f48CNA
Linuxdd66df0053ef84add5e684df517aa9b498342381 – < 493479af8af3ab907f49e99323777d498a4fbd2b493479af8af3ab907f49e99323777d498a4fbd2bCNA
Linuxdd66df0053ef84add5e684df517aa9b498342381 – < 101841c38346f4ca41dc1802c867da990ffb32eb101841c38346f4ca41dc1802c867da990ffb32ebCNA
Linux6.66.6.157CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgit.kernel.org/stable/c/4b9aee707c4580511983a0998547f3b28514e6a6refgit.kernel.org/stable/c/bb80f7618832d26f7e395f52f82b1dac76223e5frefgit.kernel.org/stable/c/3145b2b11492d61c512bbc59660bb823bc757f48refgit.kernel.org/stable/c/493479af8af3ab907f49e99323777d498a4fbd2brefgit.kernel.org/stable/c/101841c38346f4ca41dc1802c867da990ffb32eb