Linux Kernel CephFS NULL Pointer Dereference Vulnerability in MDS Authentication

A NULL pointer dereference vulnerability has been identified in the CephFS kernel client of the Linux kernel, specifically in versions 6.18-rc1 and later. The issue arises in the 'ceph_mds_auth_match()' function when the file system name is NULL. This vulnerability can lead to a denial of service by causing a kernel crash.

Impact

Exploitation of this vulnerability leads to a NULL pointer dereference, causing a kernel crash and disrupting system operations.

Reproduction

To reproduce this vulnerability, mount a CephFS file system using a kernel version 6.18-rc1 or later, and do not specify the 'mds_namespace' option. This will result in the 'fs_name' variable being NULL when 'ceph_mds_auth_match()' is called, causing a NULL pointer dereference.

Remediation

Users can upgrade to the latest stable version of the Linux kernel where this vulnerability has been fixed.