Homepage

CVE-2025-21737 Affecting kernel-uek-debug package, versions <0:6.12.0-101.33.4.3.el9uek

Severity

 Recommended
high

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.03% (7th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE9-KERNELUEKDEBUG-10779985
  • published18 Jul 2025
  • disclosed27 Feb 2025
Report a new vulnerability Found a mistake?

Introduced: 27 Feb 2025

CVE-2025-21737  (opens in a new tab)

How to fix?

Upgrade Oracle:9 kernel-uek-debug to version 0:6.12.0-101.33.4.3.el9uek or higher.
This issue was patched in ELSA-2025-20480.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-uek-debug package and not the kernel-uek-debug package as distributed by Oracle. See How to fix? for Oracle:9 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix memory leak in ceph_mds_auth_match()

We now free the temporary target path substring allocation on every possible branch, instead of omitting the default branch. In some cases, a memory leak occured, which could rapidly crash the system (depending on how many file accesses were attempted).

This was detected in production because it caused a continuous memory growth, eventually triggering kernel OOM and completely hard-locking the kernel.

Relevant kmemleak stacktrace:

unreferenced object 0xffff888131e69900 (size 128):
  comm &#34;git&#34;, pid 66104, jiffies 4295435999
  hex dump (first 32 bytes):
    76 6f 6c 75 6d 65 73 2f 63 6f 6e 74 61 69 6e 65  volumes/containe
    72 73 2f 67 69 74 65 61 2f 67 69 74 65 61 2f 67  rs/gitea/gitea/g
  backtrace (crc 2f3bb450):
    [&lt;ffffffffaa68fb49&gt;] __kmalloc_noprof+0x359/0x510
    [&lt;ffffffffc32bf1df&gt;] ceph_mds_check_access+0x5bf/0x14e0 [ceph]
    [&lt;ffffffffc3235722&gt;] ceph_open+0x312/0xd80 [ceph]
    [&lt;ffffffffaa7dd786&gt;] do_dentry_open+0x456/0x1120
    [&lt;ffffffffaa7e3729&gt;] vfs_open+0x79/0x360
    [&lt;ffffffffaa832875&gt;] path_openat+0x1de5/0x4390
    [&lt;ffffffffaa834fcc&gt;] do_filp_open+0x19c/0x3c0
    [&lt;ffffffffaa7e44a1&gt;] do_sys_openat2+0x141/0x180
    [&lt;ffffffffaa7e4945&gt;] __x64_sys_open+0xe5/0x1a0
    [&lt;ffffffffac2cc2f7&gt;] do_syscall_64+0xb7/0x210
    [&lt;ffffffffac400130&gt;] entry_SYSCALL_64_after_hwframe+0x77/0x7f

It can be triggered by mouting a subdirectory of a CephFS filesystem, and then trying to access files on this subdirectory with an auth token using a path-scoped capability:

$ ceph auth get client.services
[client.services]
        key = REDACTED
        caps mds = &#34;allow rw fsname=cephfs path=/volumes/&#34;
        caps mon = &#34;allow r fsname=cephfs&#34;
        caps osd = &#34;allow rw tag cephfs data=cephfs&#34;


$ cat /proc/self/mounts
services@[REDACTED].cephfs=/volumes/containers /ceph/containers ceph rw,noatime,name=services,secret=&lt;hidden&gt;,ms_mode=prefer-crc,mount_timeout=300,acl,mon_addr=[REDACTED]:3300,recover_session=clean 0 0


$ seq 1 1000000 | xargs -P32 --replace={} touch /ceph/containers/file-{} &amp;&amp; 
seq 1 1000000 | xargs -P32 --replace={} cat /ceph/containers/file-{}

[ idryomov: combine if statements, rename rc to path_matched and make it a bool, formatting ]

CVSS Base Scores

version 3.1