CVE-2025-14104: Red Hat Ceph Storage 7

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.

Affected products

• Red Hat Red Hat Ceph Storage 7: before 1770632724 (fixed in 1770632724)
• Red Hat Red Hat Ceph Storage 8: before 1770630907 (fixed in 1770630907)
• Red Hat Red Hat Ceph Storage 9: before 1771816028 (fixed in 1771816028)
• Red Hat Red Hat Enterprise Linux 10: before 0:2.40.2-15.el10_1 (fixed in 0:2.40.2-15.el10_1)
• Red Hat Red Hat Enterprise Linux 6
• Red Hat Red Hat Enterprise Linux 7
• Red Hat Red Hat Enterprise Linux 8: before 0:2.32.1-48.el8_10 (fixed in 0:2.32.1-48.el8_10)
• Red Hat Red Hat Enterprise Linux 9: before 0:2.37.4-21.el9_7 (fixed in 0:2.37.4-21.el9_7)
• Red Hat Red Hat Hardened Images: before 2.42-7.1.hum1 (fixed in 2.42-7.1.hum1)
• Red Hat Red Hat Insights Proxy 1.5: before 1770740405 (fixed in 1770740405)
• Red Hat Red Hat Openshift Container Platform 4
• Red Hat Red Hat Update Infrastructure 5: before 1770646925 (fixed in 1770646925); before 1773670073 (fixed in 1773670073); before 1773672059 (fixed in 1773672059); before 1773670137 (fixed in 1773670137)
• Util-Linux Util-Linux: before 2.41.3 (fixed in 2.41.3)

Published 2025-12-05. Last modified 2026-09-01.