In the Linux kernel, the following vulnerability has been resolved:
libceph: fix invalid accesses to cephconnectionv1_info
There is a place where generic code in messenger.c is reading and another place where it is writing to con->v1 union member without checking that the union member is active (i.e. msgr1 is in use).
On 64-bit systems, con->v1.authretry overlaps with con->v2.outiter, so such a read is almost guaranteed to return a bogus value instead of 0 when msgr2 is in use. This ends up being fairly benign because the side effect is just the invalidation of the authorizer and successive fetching of new tickets.
con->v1.connectseq overlaps with con->v2.connbufs and the fact that it's being written to can cause more serious consequences, but luckily it's not something that happens often.
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"123301741171494026167815941253008963766",
"184408714687036512669514324178959834819",
"222522692654897620264243690401279844722",
"312319585617646197738105947115412358945",
"162903458996595531237612002767126881153",
"257753451280306228005847043188340028280",
"225966079493065419748819904627710536598",
"271481785908642765907605580239765993507",
"124913252544344746370956231503490747136",
"121779401195724813504064864466446040171"
]
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2025-39880-099fb929",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea12ab684f8ae8a6da11a22c78d94a79e2163096",
"target": {
"file": "net/ceph/messenger.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"123301741171494026167815941253008963766",
"184408714687036512669514324178959834819",
"222522692654897620264243690401279844722",
"312319585617646197738105947115412358945",
"162903458996595531237612002767126881153",
"257753451280306228005847043188340028280",
"225966079493065419748819904627710536598",
"271481785908642765907605580239765993507",
"124913252544344746370956231503490747136",
"121779401195724813504064864466446040171"
]
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2025-39880-14e488bd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdbc9836c7afadad68f374791738f118263c5371",
"target": {
"file": "net/ceph/messenger.c"
}
},
{
"digest": {
"function_hash": "314372511107728635780567364545668975981",
"length": 348.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-39880-158c471d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23538cfbeed87159a5ac6c61e7a6de3d8d4486a8",
"target": {
"function": "clear_standby",
"file": "net/ceph/messenger.c"
}
},
{
"digest": {
"function_hash": "65491558165861396897488054294279585539",
"length": 386.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-39880-22fb78b7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea12ab684f8ae8a6da11a22c78d94a79e2163096",
"target": {
"function": "con_fault_finish",
"file": "net/ceph/messenger.c"
}
},
{
"digest": {
"function_hash": "314372511107728635780567364545668975981",
"length": 348.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-39880-2ee62d65",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea12ab684f8ae8a6da11a22c78d94a79e2163096",
"target": {
"function": "clear_standby",
"file": "net/ceph/messenger.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"123301741171494026167815941253008963766",
"184408714687036512669514324178959834819",
"222522692654897620264243690401279844722",
"312319585617646197738105947115412358945",
"162903458996595531237612002767126881153",
"257753451280306228005847043188340028280",
"225966079493065419748819904627710536598",
"271481785908642765907605580239765993507",
"124913252544344746370956231503490747136",
"121779401195724813504064864466446040171"
]
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2025-39880-4f646cbb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@591ea9c30737663a471b2bb07b27ddde86b020d5",
"target": {
"file": "net/ceph/messenger.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"123301741171494026167815941253008963766",
"184408714687036512669514324178959834819",
"222522692654897620264243690401279844722",
"312319585617646197738105947115412358945",
"162903458996595531237612002767126881153",
"257753451280306228005847043188340028280",
"225966079493065419748819904627710536598",
"271481785908642765907605580239765993507",
"124913252544344746370956231503490747136",
"121779401195724813504064864466446040171"
]
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2025-39880-5858bbf5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bd8b56899be0b514945f639a89ccafb8f8dfaef",
"target": {
"file": "net/ceph/messenger.c"
}
},
{
"digest": {
"function_hash": "65491558165861396897488054294279585539",
"length": 386.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-39880-7858ed33",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23538cfbeed87159a5ac6c61e7a6de3d8d4486a8",
"target": {
"function": "con_fault_finish",
"file": "net/ceph/messenger.c"
}
},
{
"digest": {
"function_hash": "314372511107728635780567364545668975981",
"length": 348.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-39880-9f219cb5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdbc9836c7afadad68f374791738f118263c5371",
"target": {
"function": "clear_standby",
"file": "net/ceph/messenger.c"
}
},
{
"digest": {
"function_hash": "65491558165861396897488054294279585539",
"length": 386.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-39880-a2b35892",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983",
"target": {
"function": "con_fault_finish",
"file": "net/ceph/messenger.c"
}
},
{
"digest": {
"function_hash": "314372511107728635780567364545668975981",
"length": 348.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-39880-a414609a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bd8b56899be0b514945f639a89ccafb8f8dfaef",
"target": {
"function": "clear_standby",
"file": "net/ceph/messenger.c"
}
},
{
"digest": {
"function_hash": "314372511107728635780567364545668975981",
"length": 348.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-39880-b7bc5314",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983",
"target": {
"function": "clear_standby",
"file": "net/ceph/messenger.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"123301741171494026167815941253008963766",
"184408714687036512669514324178959834819",
"222522692654897620264243690401279844722",
"312319585617646197738105947115412358945",
"162903458996595531237612002767126881153",
"257753451280306228005847043188340028280",
"225966079493065419748819904627710536598",
"271481785908642765907605580239765993507",
"124913252544344746370956231503490747136",
"121779401195724813504064864466446040171"
]
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2025-39880-c48a1736",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23538cfbeed87159a5ac6c61e7a6de3d8d4486a8",
"target": {
"file": "net/ceph/messenger.c"
}
},
{
"digest": {
"function_hash": "65491558165861396897488054294279585539",
"length": 386.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-39880-dba43211",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdbc9836c7afadad68f374791738f118263c5371",
"target": {
"function": "con_fault_finish",
"file": "net/ceph/messenger.c"
}
},
{
"digest": {
"function_hash": "65491558165861396897488054294279585539",
"length": 386.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-39880-df2f6e66",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bd8b56899be0b514945f639a89ccafb8f8dfaef",
"target": {
"function": "con_fault_finish",
"file": "net/ceph/messenger.c"
}
},
{
"digest": {
"function_hash": "65491558165861396897488054294279585539",
"length": 386.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-39880-eda999b3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@591ea9c30737663a471b2bb07b27ddde86b020d5",
"target": {
"function": "con_fault_finish",
"file": "net/ceph/messenger.c"
}
},
{
"digest": {
"function_hash": "314372511107728635780567364545668975981",
"length": 348.0
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2025-39880-efb9a2e2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@591ea9c30737663a471b2bb07b27ddde86b020d5",
"target": {
"function": "clear_standby",
"file": "net/ceph/messenger.c"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"123301741171494026167815941253008963766",
"184408714687036512669514324178959834819",
"222522692654897620264243690401279844722",
"312319585617646197738105947115412358945",
"162903458996595531237612002767126881153",
"257753451280306228005847043188340028280",
"225966079493065419748819904627710536598",
"271481785908642765907605580239765993507",
"124913252544344746370956231503490747136",
"121779401195724813504064864466446040171"
]
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2025-39880-f341a0ba",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@35dbbc3dbf8bccb2d77c68444f42c1e6d2d27983",
"target": {
"file": "net/ceph/messenger.c"
}
}
]