CVE-2025-21737

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix memory leak in ceph_mds_auth_match()

We now free the temporary target path substring allocation on every

possible branch, instead of omitting the default branch. In some

cases, a memory leak occured, which could rapidly crash the system

(depending on how many file accesses were attempted).

This was detected in production because it caused a continuous memory

growth, eventually triggering kernel OOM and completely hard-locking

the kernel.

Relevant kmemleak stacktrace:

unreferenced object 0xffff888131e69900 (size 128):

comm "git", pid 66104, jiffies 4295435999

hex dump (first 32 bytes):

76 6f 6c 75 6d 65 73 2f 63 6f 6e 74 61 69 6e 65 volumes/containe

72 73 2f 67 69 74 65 61 2f 67 69 74 65 61 2f 67 rs/gitea/gitea/g

backtrace (crc 2f3bb450):

[<ffffffffaa68fb49>] __kmalloc_noprof+0x359/0x510

[<ffffffffc32bf1df>] ceph_mds_check_access+0x5bf/0x14e0 [ceph]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References