Description
Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and 19.0.0 through 19.2.2, an unprivileged user can escalate to root privileges in a ceph-fuse mounted CephFS by chmod 777 a directory owned by root to gain access. The result of this is that a user could read, write and execute to any directory owned by root as long as they chmod 777 it. This impacts confidentiality, integrity, and availability. It is patched in versions 17.2.8, 18.2.5, and 19.2.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ceph | ceph | = 17.2.7, >= 18.2.1, < 18.2.5, >= 19.0.0, < 19.2.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ceph | 18.2.6-1 | — |
| Debian 13 | ceph | 18.2.6-1 | — |
| Debian 12 | ceph | 16.2.15+ds-0+deb12u2 | — |
| Debian 11 | ceph | 14.2.21-1+deb11u1 | DLA-4310-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ceph Storage 7 | ceph +25 | 2:18.2.1-381.el8cp | RHSA-2026:2769 |
| Red Hat Ceph Storage 7 | cephadm | 2:18.2.1-381.el9cp | RHSA-2026:2769 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ceph | 18.2.2-9 | — |
Advisories 2
- RHSA-2026:2769 Red Hat Security Advisory: Red Hat Ceph Storage 7.1 security and bug fix updates Red Hat Security Advisories (RHSA) · Oct 20, 2026
- DLA-4310-1 ceph - security update Debian Security (DSA / DLA) · Sep 25, 2025