Skip to content
Fencer Vulns
high 7.8

CVE-2025-39927 json

ceph: fix race condition validating r_parent before applying state

published 2025-10-01 13 mo ago modified 2026-10-21 19 d ago also EUVD-2025-32883

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 4%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix race condition validating r_parent before applying state

Add validation to ensure the cached parent directory inode matches the directory info in MDS replies. This prevents client-side race conditions where concurrent operations (e.g. rename) cause r_parent to become stale between request initiation and reply processing, which could lead to applying state changes to incorrect directory inodes.

[ idryomov: folded a kerneldoc fixup and a follow-up fix from Alex to move CEPH_CAP_PIN reference when r_parent is updated:

When the parent directory lock is not held, req->r_parent can become stale and is updated to point to the correct inode. However, the associated CEPH_CAP_PIN reference was not being adjusted. The CEPH_CAP_PIN is a reference on an inode that is tracked for accounting purposes. Moving this pin is important to keep the accounting balanced. When the pin was not moved from the old parent to the new one, it created two problems: The reference on the old, stale parent was never released, causing a reference leak. A reference for the new parent was never acquired, creating the risk of a reference underflow later in ceph_mdsc_release_request(). This patch corrects the logic by releasing the pin from the old parent and acquiring it for the new parent when r_parent is switched. This ensures reference accounting stays balanced. ]

Patch / fix

  • Linux Linux 6.6.160, 6.12.48, 6.16.8, 6.17
  • linux Debian 13 6.12.48-1
  • linux Debian 14 6.16.8-1

debian advisories DEBIAN-CVE-2025-39927

  • linux Ubuntu 24.04 LTS 6.8.0-106.106
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1050.53
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1052.55
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1048.53
  • linux-ibm Ubuntu 24.04 LTS 6.8.0-1049.49
  • linux-azure Ubuntu 24.04 LTS 6.8.0-1051.57
  • linux-gkeop Ubuntu 24.04 LTS 6.8.0-1035.38
  • linux-raspi Ubuntu 24.04 LTS 6.8.0-1050.54

ubuntu advisories UBUNTU-CVE-2025-39927

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 9.4 EUS 5.14.0-427.92.1.el9_4
  • rv RHEL 9.4 EUS 5.14.0-427.92.1.el9_4
  • perf RHEL 9.4 EUS 5.14.0-427.92.1.el9_4
  • rtla RHEL 9.4 EUS 5.14.0-427.92.1.el9_4
  • bpftool RHEL 9.4 EUS 7.3.0-427.92.1.el9_4
  • libperf RHEL 9.4 EUS 5.14.0-427.92.1.el9_4
  • kernel-rt RHEL 9.4 EUS 5.14.0-427.92.1.el9_4
  • kernel-64k RHEL 9.4 EUS 5.14.0-427.92.1.el9_4

red hat advisories RHSA-2025:17241

  • kernel-rt Linux Micro 6.2 6.12.0-160000.26.1
  • kernel-64kb SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.26.1
  • kernel-source SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.26.1
  • kernel-default SLES 16.0, SLE High Availability Extension 16.0, Linux Micro 6.2 +1 more 6.12.0-160000.26.1
  • kernel-default-base SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.26.1.160000.2.7
  • kernel-syms SLES 16.0, Linux Micro Extras 6.2, SLES for SAP applications 16.0 6.12.0-160000.26.1
  • kernel-azure SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.26.1
  • kernel-obs-qa SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.26.1

suse advisories SUSE-SU-2026:20555-1SUSE-SU-2026:20599-1SUSE-SU-2026:20615-1SUSE-SU-2026:20570-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.26.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.26.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.26.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.26.1
  • kernel-azure openSUSE Leap 16.0 6.12.0-160000.26.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.26.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.26.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.26.1

opensuse advisories openSUSE-SU-2026:20287-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-39927 updated cvss 6.4

kernel: ceph: fix race condition validating r_parent before applying state

  • Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
    affected: no fix available “Fix deferred”
  • Red Hat CodeReady Linux Builder EUS (v.9.4) libperf 5.14.0-427.92.1.el9_4, kernel-debuginfo-common-s390x 5.14.0-427.92.1.el9_4, kernel-debuginfo-common-x86_64 5.14.0-427.92.1.el9_4, kernel-debuginfo-common-aarch64 5.14.0-427.92.1.el9_4, kernel-debuginfo-common-ppc64le 5.14.0-427.92.1.el9_4 Red Hat Enterprise Linux AppStream EUS (v.9.4) rv 5.14.0-427.92.1.el9_4, perf 5.14.0-427.92.1.el9_4, rtla 5.14.0-427.92.1.el9_4, kernel-devel-matched 5.14.0-427.92.1.el9_4, kernel-64k-devel-matched 5.14.0-427.92.1.el9_4, kernel-debug-devel-matched 5.14.0-427.92.1.el9_4, +6 more Red Hat Enterprise Linux BaseOS EUS (v.9.4) bpftool 7.3.0-427.92.1.el9_4, kernel 5.14.0-427.92.1.el9_4, kernel-64k 5.14.0-427.92.1.el9_4, kernel-core 5.14.0-427.92.1.el9_4, kernel-tools 5.14.0-427.92.1.el9_4, python3-perf 5.14.0-427.92.1.el9_4, +28 more Red Hat Enterprise Linux Real Time EUS (v.9.4) kernel-rt 5.14.0-427.92.1.el9_4, kernel-rt-core 5.14.0-427.92.1.el9_4, kernel-rt-modules 5.14.0-427.92.1.el9_4, kernel-rt-debug-core 5.14.0-427.92.1.el9_4, kernel-rt-modules-core 5.14.0-427.92.1.el9_4, kernel-rt-debug-modules 5.14.0-427.92.1.el9_4, +4 more Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4) kernel-rt 5.14.0-427.92.1.el9_4, kernel-rt-kvm 5.14.0-427.92.1.el9_4, kernel-rt-core 5.14.0-427.92.1.el9_4, kernel-rt-modules 5.14.0-427.92.1.el9_4, kernel-rt-debug-kvm 5.14.0-427.92.1.el9_4, kernel-rt-debug-core 5.14.0-427.92.1.el9_4, +6 more
    fixed: vendor fix RHSA-2025:17241
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
9 mo ago

Exploit prediction

0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.