Executive brief
The Linux kernel's Ceph client library contains a heap buffer overflow vulnerability in its CRUSH map decoder. An attacker can craft a malicious CRUSH map that causes the kernel to write past allocated memory boundaries, potentially leading to kernel crashes or arbitrary code execution on systems using Ceph storage.
Technical details
The vulnerability exists in the crush_decode() function in net/ceph/osdmap.c, which parses CRUSH maps used for data placement in Ceph storage clusters. The decoder stores bucket data by array slot but derives the per-bucket workspace index from the bucket id. A malformed CRUSH map can encode a bucket id that differs from the canonical value (-1 - slot), causing bucket workspace aliasing. During uniform bucket replica selection, if the source bucket is larger than the aliased bucket, the permutation write overflows the smaller buffer and escapes the kvmalloc'd CRUSH workspace, as detected by KASAN (4-byte out-of-bounds write in bucket_perm_choose()). The fix validates that bucket ids match their array slots before processing. An attacker controlling a CRUSH map (e.g., via a compromised Ceph monitor or man-in-the-middle position) can exploit this to trigger kernel memory corruption.
Affected products
- Linux Linux kernel All versions (patched in commit 3cde4a8302301679937474a5f7a851394cc1bd11)
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched: Kernel commit 3cde4a8302301679937474a5f7a851394cc1bd11 merged into stable tree