CVE-2025-40362 describes a vulnerability in the Linux kernel's Ceph filesystem where the multifs MDS authorization caps check failed to validate the filesystem name (fsname) alongside the associated capabilities. This allowed the MDS auth caps of one filesystem to be incorrectly applied to another filesystem within a multifs Ceph cluster. As a result, a user authorized with read-only permissions on one filesystem could perform unauthorized write operations on that filesystem by leveraging the write permissions granted on a different filesystem. The vulnerability was demonstrated by mounting the read-only filesystem and successfully creating and deleting files, actions that should have been denied. The issue was fixed by updating the MDS auth caps check to validate fsname properly, preventing cross-filesystem capability application.

The vulnerability allows unauthorized privilege escalation within a Ceph multifs cluster by applying the authorization capabilities of one filesystem to another. This leads to unauthorized write access on filesystems where the user should only have read permissions, compromising confidentiality, integrity, and availability of data on affected filesystems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description references a resolved fix in the Linux kernel Ceph component, indicating that an official fix exists. Users should monitor the official Linux kernel and Ceph project advisories for patches addressing CVE-2025-40362 and apply them promptly once available. Until patched, restrict access to Ceph clusters and carefully manage user permissions to minimize risk.