Linux libceph: malformed OSD sparse-read reply advances the message cursor past the request buffer and panics

Impact

osd_sparse_read() checks that the sparse-read data length matches the summed extent lengths but never checks that each OSD-supplied extent is monotonic and lies inside the original request range. A reply advertising a far-forward extent offset with a matching data length drives the message-data cursor beyond the request buffer and reaches the BUG_ON(!*length) in ceph_msg_data_next() on the receive path. The record states the impact plainly: a malicious or compromised authenticated OSD can crash a kernel Ceph client. On a GPU node with RBD or CephFS mounted this is an unplanned node loss and the death of whatever job was resident - denial of service, with no indication of memory disclosure or code execution.

Who can reach it

Requires an authenticated Ceph OSD peer - a compromised OSD, or an attacker able to impersonate one on the storage network. Not reachable from a tenant workload on the node.

What to do

Update to a stable kernel carrying the fix (four backport commits linked on the record); the fix rejects sparse extent maps that overflow, move backwards, overlap, or extend outside the request. Drain and reboot each node with a kernel Ceph client - libceph cannot be reloaded under a live mount. Batch with the other libceph fixes from the same day.

References

Related entries

• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
• VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
• Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical
• Linux kernel (drivers/nvme/host): The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, soCVE-2021-47378 · Linux kernel (drivers/nvme/host)Critical
• Linux kernel (net/tls): KTLS stored a negative errno into the socket error field where a positive value is expected. ACVE-2021-47496 · Linux kernel (net/tls)Critical