Executive brief
A vulnerability was identified in the Linux kernel's Ceph network storage client. A specially crafted or corrupted network message could cause the system to crash by triggering a null pointer dereference during the processing of storage maps. This could lead to a denial-of-service (system crash) for systems using Ceph storage.
Technical details
A null pointer dereference vulnerability exists in the libceph module of the Linux kernel within the decode_choose_args() function. When processing CEPH_MSG_OSD_MAP messages, the CRUSH map decoding logic fails to verify if a bucket index points to a valid bucket before accessing it. An attacker or a corrupted OSD map could provide a bucket_index that points to a NULL entry in the buckets array, leading to a kernel panic. The fix introduces a check to ensure the bucket is not NULL before attempting to access its size property. Patch commits have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel versions prior to 6.10-rc1
Timeline
- 2026-05-12: other: Patch authored and reviewed
- 2026-06-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/28b0a2ab8c82d0bbdeb8013029c67c978ce6e4bf
- https://git.kernel.org/stable/c/301286c0ccd37d66b0e40786fd35a4f19cdbd88a
- https://git.kernel.org/stable/c/312ec973efac0efb9b9ed64214235910e9ecbaa8
- https://git.kernel.org/stable/c/7169f326a23d0f547fcd90e68b72fd387622e126
- https://git.kernel.org/stable/c/a20e16ebfe2fa65348eb4b2dc7deac330ce03e9c
- https://git.kernel.org/stable/c/d55ffad8d422b5d1cc44dad32bd3d25f4471cd9f
- https://git.kernel.org/stable/c/d7a65a34d2453f8cd3e0cc0e1319740af7e24276