Executive brief
A vulnerability was identified in the Linux kernel's Ceph network storage client. The flaw occurs when processing storage map messages (OSD maps) that contain inconsistent data about how data is distributed across the cluster. An attacker or a compromised storage server could send a specially crafted message that causes the system to access memory incorrectly, potentially leading to a system crash or instability.
Technical details
A vulnerability exists in the libceph implementation within the Linux kernel's net/ceph/osdmap.c. When decoding a CEPH_MSG_OSD_MAP message, the crush_decode() function processes buckets that contain two separate fields for the bucket algorithm. The first field is used to determine the memory allocation size, while the second field (b->alg) is used for subsequent processing. If these fields differ, an out-of-bounds access occurs. Additionally, the crush_destroy_bucket function could trigger a similar out-of-bounds access during error cleanup. The fix implements a consistency check between the two algorithm fields and centralizes memory deallocation to prevent invalid free operations.
Affected products
- Linux Linux Kernel All versions before 6.9.2, 6.6.32, 6.1.92, 5.15.160, 5.10.218, 5.4.277, 4.19.315, 4.14.346
Timeline
- 2026-04-22: other: Patch submitted by author
- 2026-05-11: patched: Patch committed to mainline kernel
- 2026-06-24: advisory: CVE published
References
- https://git.kernel.org/stable/c/0f3604cbe4df14c5e58288ac9f57511e726a222d
- https://git.kernel.org/stable/c/3f42508191e129ee6b5ea96578d5cab14f2a013a
- https://git.kernel.org/stable/c/4c79fc2d598694bda845b46229c9d48b65042970
- https://git.kernel.org/stable/c/6e70ef53e818c53eab28d7b0026b7fd03dddaba5
- https://git.kernel.org/stable/c/cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5
- https://git.kernel.org/stable/c/ea0d42137f0c06da71e37ffc647aab4c5309599a
- https://git.kernel.org/stable/c/ebe76d58a48a48031b98543d86c4cd30a825b622