Executive brief
A vulnerability in the Linux kernel's Ceph storage client could allow a remote attacker to cause a system to attempt an excessively large memory allocation. This occurs when the system processes a specially crafted message from a storage monitor. If successful, this can lead to a denial-of-service condition where the system becomes unstable or unresponsive due to memory exhaustion.
Technical details
A signedness bug exists in the libceph module within the ceph_monmap_decode() function in net/ceph/mon_client.c. The variables 'blob_len' and 'num_mon' were incorrectly defined as signed integers while being assigned unsigned 32-bit values via ceph_decode_32_safe(). An attacker providing a very large value for 'num_mon' in an incoming message can bypass the 'num_mon > CEPH_MAX_MON' check because the large unsigned value is interpreted as a negative integer. This results in the kernel attempting to allocate a massive chunk of memory for the monmap, leading to an out-of-memory (OOM) condition or a failed allocation returning -ENOMEM. The fix involves changing these variable types to u32 to ensure proper bounds checking.
Affected products
- Linux Linux Kernel 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9
Timeline
- 2026-02-26: other: Patch authored
- 2026-05-08: disclosed: CVE published
- 2026-05-08: advisory
References
- https://git.kernel.org/stable/c/08bc6173fd611ad5a40f472bf5f15b92aea0fe40
- https://git.kernel.org/stable/c/5f2806684b05bd24d05c091083b8e2517ba8ffac
- https://git.kernel.org/stable/c/770444611f047dbfd4517ec0bc1b179d40c2f346
- https://git.kernel.org/stable/c/86f7060cd638d6eb042e8ed780fb83a59ca0dcb3
- https://git.kernel.org/stable/c/b268984ae88cb0dcd7a8e8263962c748448e26e8
- https://git.kernel.org/stable/c/ba0a4df8c563536857dcbf7b4dbd0f2a15f57ace
- https://git.kernel.org/stable/c/ee5588e2bc41acb73f6676c0520420c107cd0140