EUVD-2026-76568
GHSA-qwcm-8gh9-xc6h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Malformed CRUSH map is monitor/OSDmap-sourced, so AV:A and AC:H (needs rogue monitor or MITM on unsigned messenger); 4-byte OOB write is primarily a crash (A:H), minor integrity, no disclosure.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
libceph: reject buckets with mismatched CRUSH ids
crush_decode() stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket reuse another bucket's workspace by encoding an id different from -1 - slot.
For uniform buckets, the second replica selection expands the source bucket's permutation into that aliased workspace buffer. If the source bucket is larger than the aliased bucket, the write runs past the smaller permutation array and can escape the kvmalloc'd CRUSH workspace. KASAN reports a slab OOB write of 4 bytes in bucket_perm_choose().
Reject buckets whose encoded id does not match their array slot. Valid CRUSH maps already use the canonical negative id corresponding to the bucket slot, so this restores the invariant expected by work->work[-1 - in->id] without changing valid map behavior.
AnalysisAI
Out-of-bounds slab write in the Linux kernel's libceph/CRUSH map decoder (crush_decode) lets a malformed CRUSH map corrupt kernel memory on any RADOS client (Ceph RBD or CephFS). Because crush_decode() stores buckets by array slot while the mapper derives each bucket's workspace index from its decoded id, a map encoding an id different from '-1 - slot' makes one bucket alias another's kvmalloc'd workspace; a uniform bucket's second-replica permutation then overflows the smaller aliased buffer, producing a 4-byte OOB write in bucket_perm_choose() confirmed by KASAN. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a mounted Ceph RADOS client (RBD block device or CephFS) that decodes CRUSH maps, plus the ability to deliver a malformed CRUSH/OSD map - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates real-world risk: the malicious data is a CRUSH/OSD map that only reaches the client from the Ceph monitor cluster, so the realistic vector is adjacent and gated (a compromised/rogue monitor, or MITM on an unsigned/unencrypted messenger session) with meaningful attack complexity - closer to AV:A/AC:H, and the 4-byte OOB write is DoS-leaning rather than a clean C:H info-leak, so 'Information Disclosure' mislabels an OOB write. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update to Linux 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (or the corresponding distribution kernel that backports stable commit 3516a4131c4e/00562ccd4e88/79900d978158/3cde4a830230), which rejects any bucket whose encoded id does not match its array slot without changing valid-map behavior. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems with Ceph client mounts (RBD/CephFS) and determine which run Linux kernel versions prior to 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Share
External POC / Exploit Code
Leaving vuln.today