CVE-2025-71116

In the Linux kernel, the following vulnerability has been resolved:

libceph: make decode_pool() more resilient against corrupted osdmaps

If the osdmap is (maliciously) corrupted such that the encoded length of ceph_pg_pool envelope is less than what is expected for a particular encoding version, out-of-bounds reads may ensue because the only bounds check that is there is based on that length value.

This patch adds explicit bounds checks for each field that is decoded or skipped.

The Ceph client could perform out-of-bounds reads when decoding a corrupted or maliciously crafted osdmap, because the parser trusted length fields without validating each decoded or skipped element. This allows a remote Ceph peer to crash the kernel and cause a denial of service. Although this issue is triggered over an authenticated Ceph connection, the attack direction is from the server side (OSD/monitor) to the client. Any compromised or malfunctioning Ceph node can provide a malformed osdmap that is parsed in the kernel, breaking Ceph’s security model which assumes that no cluster component should be able to crash or compromise a client, even over an authorized channel.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue and if Ceph not being used, then prevent module libceph from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.