Linux kernel libceph: unchecked OSD index from network packets panics the client node

Impact

OSD indexes arriving in Ceph map messages were trusted without validation and reached a BUG_ON, so a malformed or hostile map crashes the kernel on any node mounting CephFS or RBD through the in-kernel client. On a GPU fleet that keeps datasets and checkpoints on Ceph, every compute node is a kernel Ceph client, so the blast radius is the nodes themselves and not the storage cluster. A kernel panic takes down whatever training or inference job held the node, and recovery is a reboot rather than a service restart. The fix replaces the BUG_ON with a bounds check against map->max_osd.

Who can reach it

Anyone able to put packets on the storage network that the kernel Ceph client accepts as map data - a compromised or spoofed monitor/OSD on the storage VLAN. No authentication to the node itself is needed; reachability of the storage path is the requirement.

What to do

Take the stable kernel containing the libceph bounds-check commit from your distribution and reboot each affected node; the fix is in kernel code loaded at boot, so there is no live-patch-free path short of a vendor hot-patch. Until then, keep the Ceph public network off any segment tenants can reach. No fixed mainline version is stated in the record beyond the listed stable commits.

References

Related entries

• OpenSSL: QUIC listener queues unlimited pending connections, exhausting server memoryCVE-2026-14456 · OpenSSL QUIC server listener (pending-connection queue, 3.5+)High
• OpenSSL: raw-public-key endpoints with no certificate abort on a peer-sent signature_algorithms_cert extensionCVE-2026-14457 · OpenSSL TLS endpoint (RFC 7250 raw public keys, private key configured without a certificate)High
• OpenSSL QUIC: malformed INITIAL packet double-frees the record-layer object and kills the server processCVE-2026-18798 · OpenSSL QUIC server (port_default_packet_handler / port_bind_channel QRX object)High
• Linux kernel (drivers/nvme/target): Ordinary client I/O to an nvmet block-device namespace can hit a completion raceCVE-2026-23148 · Linux kernel (drivers/nvme/target)High
• Linux kernel (net/tls): The queue that pins encrypted input buffers while the AEAD engine still references them wasCVE-2026-23414 · Linux kernel (net/tls)High
• Linux kernel mlx5_core IPsec full offload (ESN handling): The extended-sequence-number wrap event can be processedCVE-2026-23440 · Linux kernel mlx5_core IPsec full offload (ESN handling)High