Executive brief
A flaw in the Linux kernel's CephFS filesystem client allows an attacker controlling or intercepting communications from a Ceph monitor to trigger an out-of-bounds memory read. An attacker can craft a malicious MDS map message that causes the kernel to read memory outside of allocated buffers, potentially leading to kernel crashes or information disclosure on systems using CephFS storage.
Technical details
The vulnerability is a missing bounds check in ceph_mdsmap_decode() (fs/ceph/mdsmap.c) when processing MDS map info version 2 or 3. The function reads an attacker-controlled num_export_targets value and advances the decode cursor without validating that the required bytes remain in the buffer. For info_v >= 4, an upper-bound check prevents the issue, but for v2/v3 the info_end pointer is NULL, bypassing bounds validation. A malicious or compromised Ceph monitor can send a crafted MDS map with an oversized num_export_targets field, causing ceph_decode_32() to read out-of-bounds memory. The fix adds a ceph_decode_need() bounds check for all info_v >= 2 and uses safe integer arithmetic (size_mul()) to prevent multiplication overflow on attacker input.
Affected products
- Linux Linux kernel versions with CephFS support and MDS map info v2/v3 handling
Timeline
- 2026-09-11: disclosed