CVE-2025-40362

A flaw was found in the Linux kernel, specifically within the Ceph filesystem. In a multi-filesystem Ceph cluster, the metadata server (MDS) authentication capabilities check did not properly validate the filesystem name. This oversight allowed the authentication capabilities intended for one filesystem to be incorrectly applied to another. A local user could exploit this vulnerability to bypass established file system permissions, thereby gaining unauthorized read and write access to files on a filesystem where their access should have been restricted.

A moderate severity vulnerability was found in the Ceph filesystem implementation of the Linux kernel as shipped in Red Hat Enterprise Linux. In a Ceph cluster configured with multiple filesystems, the metadata server (MDS) authentication capabilities check did not validate the filesystem name, so capabilities granted to a client for one filesystem could be incorrectly applied to another filesystem. A local user with valid Ceph credentials could exploit this flaw to bypass intended filesystem permissions and gain unauthorized read and write access, such as creating or deleting files, on a filesystem where their access should have been restricted. Red Hat rates this flaw as Moderate severity (CVSS 5.5), while the upstream CVE record rates it Important (8.8); the difference reflects the differing CVSS scope and confidentiality/integrity/availability impact metrics applied in each assessment, and practical exploitation requires a multi-filesystem Ceph cluster with an attacker who already holds valid Ceph credentials granted different capabilities on different filesystems. For affected Red Hat Enterprise Linux 7 through 10 kernel and kernel-rt streams, the fix is currently deferred; the residual risk is that a local, authenticated user could obtain unauthorized read/write access across filesystems within a multi-filesystem Ceph cluster. Red Hat Enterprise Linux 6 Extended Lifecycle Support and Red Hat In-Vehicle OS 1.1 are not affected because the vulnerable code is not present in those products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.