CVE-2025-38660

low-risk
Published 2025-08-22

In the Linux kernel, the following vulnerability has been resolved: [ceph] parse_longname(): strrchr() expects NUL-terminated string ... and parse_longname() is not guaranteed that. That's the reason why it uses kmemdup_nul() to build the argument for kstrtou64(); the problem is, kstrtou64() is not the only thing that need it. Just get a NUL-terminated copy of the entire thing and be done with that...

Do I need to act?

-
0.02% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Linux

References (4)

Patch https://git.kernel.org/stable/c/101841c38346f4ca41dc1802c867da990ffb32eb
Patch https://git.kernel.org/stable/c/3145b2b11492d61c512bbc59660bb823bc757f48
Patch https://git.kernel.org/stable/c/493479af8af3ab907f49e99323777d498a4fbd2b
Patch https://git.kernel.org/stable/c/bb80f7618832d26f7e395f52f82b1dac76223e5f
23
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal