EUVD-2026-76569
GHSA-9478-77xp-cr7g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attacker must be an authenticated OSD (PR:L) on an adjacent cluster network (AV:A); availability-only impact, no data exposure.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
libceph: validate OSD extent maps before cursor advance
net/ceph/osd_client.c:osd_sparse_read() validates that the sparse-read data length matches the summed extent lengths, but it does not validate that each OSD-supplied extent is monotonic and lies inside the original request range. A malformed authenticated OSD reply can advertise a far-forward nonzero extent offset with a matching data length and make the client advance the message-data cursor beyond the request buffer. This reaches the BUG_ON(!*length) assertion in ceph_msg_data_next() from the client receive path.
Impact: A malicious or compromised authenticated Ceph OSD peer can crash a kernel Ceph client via a malformed sparse-read reply.
Reject sparse extent maps that overflow, move backwards, overlap, or extend outside the original sparse-read request before advancing the cursor.
[ idryomov: perform sparse_extent_map_valid() check a bit earlier, in CEPH_SPARSE_READ_DATA_LEN instead of CEPH_SPARSE_READ_DATA_PRE state ]
AnalysisAI
Kernel crash in the Linux libceph client allows a malicious or compromised authenticated Ceph OSD to trigger a BUG_ON assertion in ceph_msg_data_next() by sending a crafted sparse-read reply. The flaw in net/ceph/osd_client.c:osd_sparse_read() validates total data length against summed extents but omits per-extent monotonicity, overlap, and bounds checks, enabling a far-forward extent offset to advance the message-data cursor past the request buffer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target Linux system must have a Ceph volume actively mounted - either CephFS or an RBD block device; (2) the attacker must control, compromise, or successfully MITM-impersonate an authenticated Ceph OSD that the client trusts; (3) a sparse-read operation must be in flight from the client to that OSD. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) materially overstates real-world exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade to Linux kernel 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1, applying the respective fix commit from git.kernel.org/stable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems with mounted Ceph storage and document kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today