Executive brief
A vulnerability exists in the Linux kernel's Ceph network storage client. A malicious or compromised storage server could send a specially crafted 'osdmap' (a data structure describing the storage cluster) that causes the client system to read memory outside of intended boundaries. This could lead to system instability, crashes, or the exposure of sensitive information from the system's memory.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel's libceph module within the decode_pool() function in net/ceph/osdmap.c. The vulnerability is caused by insufficient bounds checking when decoding ceph_pg_pool envelopes. If a maliciously corrupted osdmap is processed where the encoded length is less than expected for a specific encoding version, the decoder may perform reads beyond the allocated buffer because it relies solely on the provided length value without field-level validation. An attacker with the ability to provide a corrupted osdmap (e.g., a compromised OSD or monitor) can trigger this flaw to cause a denial of service or potentially leak kernel memory. The fix introduces explicit bounds checks for every field decoded or skipped during the process.
Affected products
- Linux Linux Kernel 3.9 to 6.12.64, 6.1.160, 5.15.198, 5.10.248
Timeline
- 2025-12-02: patched: Initial patch authored by Ilya Dryomov
- 2026-01-14: disclosed: CVE published
References
- https://git.kernel.org/stable/c/145d140abda80e33331c5781d6603014fa75d258
- https://git.kernel.org/stable/c/2acb8517429ab42146c6c0ac1daed1f03d2fd125
- https://git.kernel.org/stable/c/5d0d8c292531fe356c4e94dcfdf7d7212aca9957
- https://git.kernel.org/stable/c/8c738512714e8c0aa18f8a10c072d5b01c83db39
- https://git.kernel.org/stable/c/c82e39ff67353a5a6cbc07b786b8690bd2c45aaa
- https://git.kernel.org/stable/c/d061be4c8040ffb1110d537654a038b8b6ad39d2
- https://git.kernel.org/stable/c/e927ab132b87ba3f076705fc2684d94b24201ed1