Listen to this Post
How the CVE Works
A race condition exists in the Linux kernel’s Ceph filesystem client. During concurrent operations like file renames, the cached parent directory inode pointer (req->r_parent) in a client request can become stale between the time the request is sent and when the server’s (MDS) reply is processed. This happens if another operation changes the file’s parent directory after the request is initiated but before the reply is handled. The kernel failed to validate that the cached `r_parent` still matched the directory information in the MDS reply before applying state changes from the reply. Consequently, directory metadata updates (like capabilities) could be incorrectly applied to the wrong, stale directory inode. Furthermore, a reference-counting object called CEPH_CAP_PIN, which is tied to the r_parent, was not properly transferred when the parent pointer was updated. This created a dual problem: a reference leak on the old, stale parent inode (preventing its cleanup) and a missing reference on the new, correct parent inode, risking a reference underflow crash later in ceph_mdsc_release_request().
DailyCVE Form
Platform: Linux Kernel
Version: Affected versions
Vulnerability: Race Condition
Severity: Critical
Date: 2025-10-01
Prediction: 2025-09-24
What Undercode Say
Check for kernel commits related to the fix
git log --oneline --grep="CVE-2025-39927" --grep="ceph" --grep="r_parent"
Example code change logic (simplified)
Before patch: State applied without validating r_parent against MDS reply.
After patch: Validation added; CEPH_CAP_PIN reference moved when r_parent is updated.
if (req->r_parent != reply->parent_inode) {
release_pin(req->r_parent);
req->r_parent = get_new_parent(reply);
acquire_pin(req->r_parent);
}
How Exploit
Trigger concurrent rename operations to cause `r_parent` to point to a stale directory, leading to filesystem metadata corruption or a kernel crash from reference underflow.
Protection from this CVE
Apply the official kernel patch that adds parent validation and corrects `CEPH_CAP_PIN` reference handling during `r_parent` updates.
Impact
Filesystem metadata corruption, kernel memory reference leaks, potential use-after-free or kernel panic due to reference underflow.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
