CVE-2025-68284: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68284 is an out-of-bounds write vulnerability in the Linux kernel's libceph component, specifically within the handle_auth_session_key() function. The flaw arises because the len field sourced from untrusted network packets was not properly validated before use, enabling potential out-of-bounds writes during connection secret decryption or service ticket processing. It was published on December 16, 2025, and affects the Linux kernel across a wide range of stable versions. It carries a CVSS v3.1 base score of 7.0 (High) (Red Hat CVE, MSRC).

The root cause is insufficient boundary checking on the len field parsed from untrusted network packets in the handle_auth_session_key() function of the libceph kernel module (CWE-787: Out-of-bounds Write). An attacker capable of sending malformed Ceph authentication session key packets — for example, by acting as a rogue Ceph monitor or man-in-the-middle on the Ceph network — could supply a crafted len value that causes the kernel to write beyond allocated buffer boundaries when decrypting the connection secret or processing service tickets. The fix adds explicit boundary checks before these operations proceed (Red Hat CVE, EUVD).

Successful exploitation could result in high impacts to confidentiality, integrity, and availability of the affected system. An attacker could corrupt kernel memory, potentially leading to privilege escalation, arbitrary code execution in kernel context, or system crashes. Sensitive data such as Ceph connection secrets could also be exposed or tampered with, and in environments using Ceph-backed storage, this could affect the integrity of storage operations across the cluster (Red Hat CVE).

Patches have been released for multiple Linux kernel stable branches. Administrators should update to the following patched versions or later: 5.15.197, 6.1.159, 6.6.119, 6.12.61, 6.17.11, or 6.18 (Red Hat CVE). Downstream distributions including Ubuntu (USN-8094, USN-8096, USN-8152 series), SUSE/openSUSE, Debian (DLA-4436-1), Amazon Linux 2, and Oracle Linux have also issued kernel updates incorporating this fix. As a workaround where patching is not immediately possible, restricting network access to Ceph monitor ports and enforcing strict network segmentation for Ceph traffic can reduce exposure.