Linux kernel libceph: osdmap_decode() under-counts osd_weight, allowing out-of-bounds reads

Impact

osdmap_decode() decodes osd_state and osd_weight once per OSD (max_osd times) but its ceph_decode_need() check accounted for sizeof(*map->osd_weight) only once. A corrupted osdmap whose max_osd exceeds the real message contents therefore walks past the end of the buffer. This is the kernel Ceph client on the compute node parsing a map update from the monitors, so on a GPU fleet the consequence is a kernel-context out-of-bounds read - a node crash that takes down the jobs on it - triggered from the storage network rather than from tenant workloads. Nodes without CephFS or RBD mounts are unaffected.

Who can reach it

A compromised Ceph monitor or an attacker able to forge or modify osdmap updates on the storage network reaching a node's kernel Ceph client. No node credentials needed.

What to do

Update the kernel to a stable release where the decode check multiplies by map->max_osd (commits in the record), then drain and reboot each node with a Ceph mount. No runtime mitigation exists in the client; restrict the Ceph monitor network to trusted hosts and use msgr2 secure mode in the meantime.

References

Related entries

• Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.c: Nvmet_auth_reply()CVE-2026-64319 · Linux kernel - NVMe-oF target DH-HMAC-CHAP authentication, drivers/nvme/target/fabrics-cmd-auth.cCritical
• Linux kernel - NVMe-oF target discovery controller, drivers/nvme/target/discovery.c: The discovery controller validatedCVE-2026-64320 · Linux kernel - NVMe-oF target discovery controller, drivers/nvme/target/discovery.cCritical
• perf tools: out-of-bounds heap read parsing a crafted perf.data CPU indexCVE-2026-80670 · Linux kernel perf tools (machine__resolve() CPU index from perf.data samples)Critical
• Linux NFSD: NFSv2 SETATTR reaches notify_change without a mount write referenceCVE-2026-89697 · Linux kernel NFSD (nfsd_proc_setattr, NFSv2 BOTH_TIME_SET path)Critical
• Linux NFSD: TOCTOU lets a SETATTR truncate an append-only fileCVE-2026-89713 · Linux kernel NFSD (nfsd_setattr ATTR_SIZE truncate permission check)Critical
• Linux kernel qla2xxx: unbounded rsp_info_len underflows sense length and leaks adjacent kernel memoryCVE-2026-89846 · Linux kernel scsi qla2xxx (FCP response rsp_info_len bound)Critical