CVE-2025-38660

In the Linux kernel, the following vulnerability has been resolved:

[ceph] parse_longname(): strrchr() expects NUL-terminated string

... and parse_longname() is not guaranteed that. That's the reason why it uses kmemdup_nul() to build the argument for kstrtou64(); the problem is, kstrtou64() is not the only thing that need it.

Just get a NUL-terminated copy of the entire thing and be done with that...

parse_longname() called strrchr() on a buffer that wasn’t guaranteed to be NUL-terminated, which could lead to out-of-bounds reads and kernel faults when parsing encrypted “long” snapshot names. The fix makes a NUL-terminated copy of the full input and avoids transient sub-copies, ensuring safe delimiter search and numeric parsing. Practically, a malicious or misconfigured Ceph server/export supplying crafted snapshot names could trigger a client kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.