CVE-2025-40362: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40362 is a Linux kernel vulnerability in the Ceph filesystem subsystem related to incorrect MDS (Metadata Server) authentication capability validation in multi-filesystem (multifs) Ceph clusters. The flaw causes the kernel to apply MDS auth caps from one filesystem to another, resulting in improper access control enforcement. It was published on December 16, 2025, and affects the Linux kernel across multiple stable branches. The EPSS score is approximately 0.039% (low), and no CVSS score has been publicly assigned at this time (Feedly, CVE.org).

The root cause is an improper authorization check (CWE-863) in the Ceph client's MDS auth caps validation logic. When a Linux kernel client connects to a multifs Ceph cluster, the code responsible for checking MDS authentication capabilities fails to validate the filesystem name (fsname) alongside the associated capability set. As a result, auth caps granted for one filesystem (e.g., read-only on fsname1) are incorrectly applied to another filesystem (e.g., fsname2), allowing a user with write permissions on fsname2 to also write to fsname1 where they should only have read access. Fixes were committed to multiple stable kernel trees, referenced at commits 22c73d52a6d0, 07640d34a781, and ca3da8b27ab9 on kernel.org (Feedly, kernel.org patch 1).

Exploitation of this vulnerability allows a Ceph client user to gain unauthorized write (or broader) access to a filesystem for which they should only have restricted permissions, violating the principle of least privilege. In a multifs Ceph cluster, this means a user authorized with read-only access to one filesystem could create, modify, or delete files on that filesystem if they hold write permissions on any other filesystem in the same cluster. The integrity and confidentiality of data stored on affected Ceph filesystems are at risk, particularly in shared multi-tenant environments (Feedly).

1. Precondition: Obtain a valid Ceph client account (e.g., client.usr) that has been authorized with different permission levels on two or more filesystems in a multifs Ceph cluster (e.g., read-only on fsname1, read-write on fsname2).
2. Obtain keyring: Retrieve the keyring for the user account: ceph auth get client.usr >> ./keyring.
3. Mount the restricted filesystem: Mount the filesystem on which the user should only have read access: sudo mount.ceph usr@.fsname1=/ /mnt/fsname1/.
4. Attempt unauthorized write: Due to the auth caps validation bug, the kernel applies the broader caps (read-write from fsname2) to fsname1. Attempt to create or modify a file: touch /mnt/fsname1/testfile.
5. Confirm unauthorized access: The file creation succeeds, confirming that write access has been improperly granted on the restricted filesystem (Feedly).

• Logs: Ceph MDS audit logs showing write operations (file creation, deletion, modification) by a user on a filesystem where they should only have read permissions.
• File System: Unexpected files or directories created on a Ceph filesystem by a user account that should be restricted to read-only access.
• Ceph Auth: Output of ceph fs authorize or ceph auth get showing mismatched permissions between what is configured and what is being enforced at the MDS level.

Apply the upstream Linux kernel patches that fix the Ceph multifs MDS auth caps validation logic. Fixes have been committed to multiple stable kernel branches (commits 22c73d52a6d0, 07640d34a781, and ca3da8b27ab9). Users should update to a patched kernel version as provided by their Linux distribution (detected by Nessus plugins 278831, 297793, 298231, 304297 and Qualys detections 760709, 760851, 6031981, 6032019). As a workaround, avoid assigning different permission levels to the same Ceph user across multiple filesystems in a multifs cluster until the patch is applied (Feedly, Tenable).