Linux kernel libceph: corrupted message frame causes out-of-bounds reads in process_message_header()

Impact

The in-kernel Ceph client decoded a message header without first checking that the control segment is at least as long as the header, so a corrupted or forged frame - or a different frame type made to look like a message frame - drives out-of-bounds reads inside the msgr worker. On a GPU fleet this is the kernel CephFS or RBD client on the compute node, not the Ceph cluster daemons: the attacker position is on the storage network between node and monitors/OSDs. A read fault here lands in a kernel workqueue, so the realistic outcome is a node-wide kernel oops that takes every running job on that node with it, and nodes with storage mounted cannot be drained cheaply. Nodes that do not mount CephFS or map RBD devices are not exposed.

Who can reach it

Anyone able to inject or tamper with traffic on the storage network path between a node's kernel Ceph client and the Ceph monitors or OSDs, or a compromised monitor/OSD. No authentication to the node itself is required; the flaw is hit while parsing the frame, before the message is trusted.

What to do

Update the kernel to a stable release containing the libceph bounds check (upstream commits linked in the record) and reboot each affected node - the fix is in the kernel's libceph module, which is in use whenever a Ceph mount is active, so there is no live patch path short of unmounting and reloading the module. On a GPU fleet that means a rolling drain and reboot. As an interim control, keep the Ceph public network off tenant-reachable VLANs and require msgr2 secure mode.

References

Related entries

• Linux kernel libceph: signed payload_len in auth replies causes slab out-of-bounds readCVE-2026-43407 · Linux kernel libceph (ceph_handle_auth_reply payload_len integer overflow)Critical
• Linux kernel libceph: positive result field in an auth reply sends kernel memory past the front bufferCVE-2026-46119 · Linux kernel libceph (auth reply result field / __send_prepared_auth_request length)Critical
• Linux kernel libceph: osdmap_decode() under-counts osd_weight, allowing out-of-bounds readsCVE-2026-52958 · Linux kernel libceph (osdmap_decode max_osd bounds check)Critical
• Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: Nvmet_auth_reply()CVE-2026-64319 · Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.cCritical
• Linux kernel - NVMe-oF target discovery controller, drivers/nvme/target/discovery.c: The discovery controller validatedCVE-2026-64320 · Linux kernel - NVMe-oF target discovery controller, drivers/nvme/target/discovery.cCritical
• perf tools: out-of-bounds heap read parsing a crafted perf.data CPU indexCVE-2026-80670 · Linux kernel perf tools (machine__resolve() CPU index from perf.data samples)Critical