Linux kernel libceph: out-of-bounds access parsing a CRUSH map with mismatched bucket algorithm fields

Impact

The in-kernel Ceph client allocates a bucket using the outer alg field of an OSD map but then processes it using the inner b->alg field. A CEPH_MSG_OSD_MAP whose two algorithm fields disagree drives an out-of-bounds read, and the mismatch is carried into teardown so freeing the map reads out of bounds again. On a GPU node this is the kernel module that mounts CephFS or maps RBD images for datasets and checkpoints, so the blast radius is a kernel-side memory error on every client node that accepts the map - typically a hang or panic on nodes holding running jobs. Trust boundary is the Ceph monitor/OSD connection: an operator who treats the storage network as semi-trusted, or any party able to inject or tamper with OSD map messages, reaches this. No exploitation has been demonstrated publicly.

Who can reach it

Whoever can deliver a CEPH_MSG_OSD_MAP to a kernel Ceph client - a compromised or malicious Ceph monitor/OSD, or an attacker on the storage network able to forge or modify map traffic where cephx and msgr2 encryption are not enforced. No credentials on the client node are required.

What to do

Take the stable-kernel fix (the commits add an alg/b->alg equality check and move the bucket kfree into the generic crush_destroy_bucket). This is a kernel change: update the kernel package and reboot each node, which means draining GPU jobs node by node. Until then, make sure cephx authentication and msgr2 secure mode are enforced so only the real monitors can hand clients a map. No vendor advisory beyond the kernel stable commits is present in the record.

References

Related entries

• Linux kernel (net/rds): If RDS/IB queue-pair setup fails after the send ring is allocated but before the receive ringCVE-2026-53355 · Linux kernel (net/rds)Critical
• Linux kernel (net/xfrm): IPTFS fragment consumption loses the shared-page marker, so ESP concludes the payload pagesCVE-2026-53363 · Linux kernel (net/xfrm)Critical
• Linux kernel nfsd: dangling IDR entry to freed layout stateid when nfsd4_layout_setlease() failsCVE-2026-53399 · Linux kernel nfsd (pNFS layout stateid teardown on setlease failure)Critical
• Linux kernel - LIO iSCSI target CHAP authentication, drivers/target/iscsi/iscsi_target_auth.cCVE-2026-63886 · Linux kernel - LIO iSCSI target CHAP authentication, drivers/target/iscsi/iscsi_target_auth.cCritical
• Linux kernel LIO iSCSI target: unbounded sprintf into the 8 KiB login response buffer overflows the heapCVE-2026-63887 · Linux kernel LIO iSCSI target (iscsi_encode_text_output login response buffer)Critical
• Linux kernel LIO iSCSI target: four-byte overread and text_in_ptr double-free in the Text PDU handlerCVE-2026-63888 · Linux kernel LIO iSCSI target (iscsit_handle_text_cmd DataDigest and text_in_ptr handling)Critical