Skip to main content

Linux Kernel CVE-2025-68283

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Network-delivered malicious OSDMap crashes the kernel with no auth or interaction, yielding availability-only impact (BUG_ON panic), so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.4 MEDIUM
AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:15 vuln.today
CVE Published
Dec 16, 2025 - 16:16 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

libceph: replace BUG_ON with bounds check for map->max_osd

OSD indexes come from untrusted network packets. Boundary checks are added to validate these against map->max_osd.

[ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic edits ]

AnalysisAI

Remote denial-of-service in the Linux kernel's libceph (Ceph client) module allows a malicious or compromised Ceph OSD/monitor to crash the kernel by sending OSDMap packets containing out-of-bounds OSD indexes. Because libceph previously used BUG_ON assertions on OSD index values drawn directly from untrusted network data, an attacker-controlled index exceeding map->max_osd triggers a kernel panic. This is a fixed issue with upstream stable-tree commits; no public exploit has been identified and EPSS exploitation probability is low (0.17%, 7th percentile).

Technical ContextAI

libceph is the in-kernel client library for Ceph distributed storage, used by the kernel CephFS filesystem and the RBD (RADOS block device) drivers to talk to a Ceph cluster. OSD (Object Storage Daemon) indexes are parsed out of OSDMap structures received over the network from Ceph monitors/OSDs, which are treated as trusted peers but whose traffic is untrusted input. The vulnerable code paths - including ceph_get_primary_affinity() - validated indexes with BUG_ON() rather than graceful bounds checks, so an index outside the [0, map->max_osd) range hit an assertion. The root cause is a reachable assertion / improper validation of an array index derived from untrusted input (CWE-617 Reachable Assertion / CWE-129 Improper Validation of Array Index); the NVD-supplied CWE is N/A. The fix replaces BUG_ON with explicit boundary checks against map->max_osd.

Affected ProductsAI

The Linux kernel's libceph subsystem (kernel CephFS and RBD/RADOS clients) is affected. NVD provides no CPE data in this input and no explicit vulnerable/fixed version ranges; affected versions are those Linux kernel releases containing the BUG_ON-based OSD index validation in libceph prior to the fix. The fix is distributed across five stable-tree commits (git.kernel.org/stable/c/57f5fbae9f1024aba17ff75e00433324115c548a, b4368b7f97014e1015445d61abd0b27c4c6e8424, becc488a4d864db338ebd4e313aa3c77da24b604, e67e3be690f5f7e3b031cf29e8d91e6d02a8e30d, ec3797f043756a94ea2d0f106022e14ac4946c02), indicating backports to multiple maintained stable branches; consult your distribution's kernel advisory for the exact patched package version.

RemediationAI

Upstream fix available (commits, not a tagged release); released patched version not independently confirmed - apply the vendor/distribution kernel update that incorporates the five libceph commits listed at git.kernel.org/stable (57f5fbae, b4368b7f, becc488a, e67e3be6, ec3797f0) and reboot into the patched kernel. Because no single upstream tag is cited here, identify the fixed version from your distribution's security tracker (Debian/Ubuntu/RHEL/SUSE) that references these commits. As compensating controls until patched: restrict Ceph client traffic to trusted monitors/OSDs and isolate the Ceph storage network on a dedicated, access-controlled VLAN to prevent spoofed OSDMap injection; enable Ceph messenger v2 with authentication/encryption (cephx, msgr2 secure mode) to reduce man-in-the-middle OSDMap tampering; and where feasible avoid mounting untrusted or attacker-controllable Ceph clusters from sensitive hosts. Note the trade-off: network isolation and msgr2 secure mode add operational/config overhead and encryption CPU cost but do not eliminate risk from a genuinely compromised OSD/monitor, so patching remains the only complete fix.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Image SL-Micro Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.105 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.124 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-68283 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy