Linux kernel libceph: unchecked length from the wire allows out-of-bounds writes in cephx auth

Impact

In libceph's cephx handshake, the length field used when decrypting the connection secret and processing service tickets came straight from network packets with no bounds check, so a crafted reply can write past the destination buffer in kernel context. The exposure is to whatever the kernel client talks to during authentication - a Ceph monitor, or anything able to answer in its place on the storage network. Nodes that mount CephFS or map RBD images with the in-kernel client carry this; the result is at minimum a kernel panic that takes the node and every GPU job on it down, with memory corruption the worse case. Clusters using only librbd/libcephfs in userspace are not affected by this code path.

Who can reach it

Whoever can answer the kernel client's cephx handshake: a compromised or impersonated Ceph monitor, or an attacker positioned on the storage network able to respond to the mounting node. No credentials on the node are needed.

What to do

Patched upstream; take the fix from your distribution's stable kernel (commits linked below) and reboot each affected node - kernel client code, so there is no way to reload it under a live mount. Drain and reboot nodes that mount CephFS or map RBD, which on a GPU fleet means draining running jobs. Until then, keep the Ceph monitor and OSD network on an isolated segment unreachable from tenant pods.

References

Related entries

• Linux kernel libceph: use-after-free racing a monmap or osdmap update during CephFS mountCVE-2025-68285 · Linux kernel libceph (have_mon_and_osd_map monmap/osdmap locking)Critical
• Linux kernel crypto: AEAD algorithms using cra_reqsize get an uninitialized reqsize, corrupting memoryCVE-2025-68726 · Linux kernel crypto AEAD framework (request size initialization)Critical
• Linux kernel qla2xxx: wrong free of a pooled purex item on the PURLS error path corrupts memoryCVE-2025-68741 · Linux kernel qla2xxx (purex item freed with kfree instead of qla24xx_free_purex_item)Critical
• Linux kernel qla2xxx: commands leak after chip reset, and racing unmaps hit a BUG_ONCVE-2025-68745 · Linux kernel qla2xxx (command cleanup after chip reset)Critical
• Linux kernel iomap: length underflow on non-block-aligned reads returns a position past the folioCVE-2025-68794 · Linux kernel iomap (iomap_adjust_read_range block alignment)Critical
• Linux kernel (net/tls): Closing a kTLS socket cancelled the transmit work item, but the write-space callback couldCVE-2026-23240 · Linux kernel (net/tls)Critical