EUVD-2026-66473
GHSA-qr98-rr7x-25v7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attacker must supply a corrupted osdmap from a trusted Ceph monitor/OSD (AC:H, PR:N as no client credentials needed); impact is an OOB read causing crash (A:H) with possible limited info leak (C:L), no integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
libceph: Avoid using invalid osd indices from primary_temp
A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts that don't exist, i.e., that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). These indices are used to create the up and acting set in ceph_pg_to_up_acting_osds(), called from calc_target(). While most of these osd indices are checked, the one from primary_temp is not. Subsequently, this may lead to calc_target() returning this (potentially invalid) index as target osd for a (linger) request. Because the osd_state, osd_weight, and osd_addr arrays only contain max_osd entries (with indices 0 to max_osd -1), this leads to out-of-bounds accesses when trying to read values from these arrays.
This patch fixes the issue by adding a check to get_temp_osds(), so that only valid osd indices from primary_temp are used, and it falls back to using the primary from pg_temp or the up set if it is invalid.
[ idryomov: changelog ]
AnalysisAI
Out-of-bounds memory access in the Linux kernel's libceph client (net/ceph) allows a malicious or corrupted Ceph osdmap to steer requests toward a non-existent OSD index. The flaw stems from an unvalidated osd index taken from the osdmap's primary_temp mapping, which is used to index the fixed-size osd_state, osd_weight, and osd_addr arrays. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target host to be running the in-kernel Ceph client (CephFS or RBD) and connected to a Ceph cluster, and requires the attacker to be able to deliver a corrupted osdmap - specifically one whose primary_temp entry contains an OSD index greater than max_osd or less than CEPH_HOMELESS_OSD (-1). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which materially overstates real-world risk for this bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who controls or has compromised a Ceph monitor or OSD (or can tamper with osdmap traffic to a client) crafts an osdmap whose primary_temp mapping references an OSD index beyond max_osd. When a linger/request on the client triggers calc_target(), get_temp_osds() returns the invalid index and the kernel reads out of bounds from osd_state/osd_weight/osd_addr, crashing the client or potentially leaking adjacent kernel memory. … |
| Remediation | Vendor-released patch: upgrade to a fixed kernel for your branch - 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, or 7.2 (or later on each series). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all systems using Ceph by querying infrastructure inventory and kernel audit logs; document the scope and business impact of each affected system. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today