Executive brief
A vulnerability in the Linux kernel's Ceph network storage client could allow an attacker to trigger an out-of-bounds memory read. This occurs when the system processes specially crafted or corrupted network messages. An exploit could lead to system instability, service outages, or the exposure of sensitive information from the system's memory.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel's libceph module, specifically within the messenger_v2.c component. The function process_message_header() fails to perform adequate bounds checking on the control segment length of incoming message frames. A remote attacker can send a maliciously corrupted frame where the control segment length is smaller than the expected message header size, or masquerade a different frame type as a message frame. This leads to an out-of-bounds read when the kernel attempts to decode the header. The vulnerability has been addressed by adding explicit bounds checks using ceph_decode_need() before header decoding.
Affected products
- Linux Linux Kernel 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-03-08: other: Patch authored
- 2026-05-08: disclosed: Initial disclosure and publication
- 2026-05-21: advisory: NVD analysis and enrichment
References
- https://git.kernel.org/stable/c/035867ae6f18df0aeedb2a57a5b74091bd4e3fe8
- https://git.kernel.org/stable/c/50156622eb0888e62541d715a98584480a1bc7cb
- https://git.kernel.org/stable/c/69fb5d91bba44ecf7eb80530b85fa4fb028921d5
- https://git.kernel.org/stable/c/69fe5af33fa3806f398d21c081d73c66e5523bc2
- https://git.kernel.org/stable/c/75582aaa580c11aed4c7731cad6b068b700e7efb
- https://git.kernel.org/stable/c/76ccf21a12c5f6d6790bc32c7da82446d877b2f4
- https://git.kernel.org/stable/c/dbd857a9e1e33ea71eaf3e211877027e533770d1