CVE-2025-71116: Linux Kernel Libceph OOB Vulnerability

CVE-2025-71116 Overview

A vulnerability has been identified in the Linux kernel's libceph component, specifically in the decode_pool() function responsible for processing Ceph OSDMap data. The vulnerability allows for out-of-bounds reads when handling maliciously corrupted OSDMaps where the encoded length of the ceph_pg_pool envelope is less than expected for a particular encoding version.

Critical Impact

Attackers with the ability to provide corrupted OSDMaps could trigger out-of-bounds memory reads, potentially leading to information disclosure or denial of service conditions on systems using Ceph storage.

Affected Products

• Linux Kernel (multiple versions with libceph support)
• Systems utilizing Ceph distributed storage
• Environments running Ceph client (libceph) kernel module

Discovery Timeline

• 2026-01-14 - CVE CVE-2025-71116 published to NVD
• 2026-01-19 - Last updated in NVD database

Technical Details for CVE-2025-71116

Vulnerability Analysis

The vulnerability exists in the decode_pool() function within the Linux kernel's libceph module. This function is responsible for parsing OSDMap data structures that describe the state and configuration of a Ceph storage cluster. The core issue is insufficient bounds checking during the decoding process.

When processing an OSDMap, the function relies on an encoded length value within the ceph_pg_pool envelope to determine the boundaries of the data structure. However, if this length value is maliciously crafted to be smaller than what is required for the declared encoding version, the function proceeds to read data beyond the legitimate boundaries of the buffer. This occurs because the bounds checking mechanism only validates against the potentially corrupted length value rather than performing explicit validation for each decoded field.

The vulnerability can be exploited in scenarios where an attacker can inject or manipulate OSDMap data that is processed by the kernel's Ceph client. This could occur through various attack vectors including man-in-the-middle attacks on Ceph cluster communication or through compromised Ceph monitor services.

Root Cause

The root cause of this vulnerability is insufficient input validation in the decode_pool() function. The function trusted the encoded length field within the ceph_pg_pool envelope without performing explicit bounds checks for each individual field during the decoding or skipping process. This allowed a mismatch between the declared envelope size and the actual data requirements for the specified encoding version, resulting in out-of-bounds memory access.

Attack Vector

The attack requires the ability to provide corrupted OSDMap data to a system running the affected libceph kernel module. An attacker could exploit this vulnerability by:

1. Crafting a malicious OSDMap with a ceph_pg_pool envelope containing a length value smaller than required for the encoding version
2. Delivering this corrupted OSDMap to the target system through Ceph cluster communication channels
3. Triggering the processing of the malicious OSDMap, causing the kernel to perform out-of-bounds reads

The vulnerability affects systems that parse OSDMap data from potentially untrusted sources. While exploitation requires specific positioning within the network or storage infrastructure, successful exploitation could lead to kernel memory information disclosure or system instability.

Detection Methods for CVE-2025-71116

Indicators of Compromise

• Unexpected kernel crashes or panics related to Ceph/libceph operations
• Memory access violations in kernel logs referencing decode_pool() or libceph functions
• Anomalous OSDMap traffic patterns or malformed Ceph protocol messages
• Kernel oops or warnings involving the ceph kernel module

Detection Strategies

• Monitor kernel logs for memory access violations related to libceph or Ceph operations
• Implement network monitoring to detect malformed or unusually small OSDMap envelopes in Ceph traffic
• Deploy kernel debugging tools to identify out-of-bounds read attempts in affected kernel modules
• Use SentinelOne Singularity to detect anomalous kernel behavior indicative of exploitation attempts

Monitoring Recommendations

• Enable kernel auditing for Ceph-related system calls and module operations
• Configure alerting for kernel panic events involving libceph components
• Monitor Ceph monitor services for signs of compromise or unauthorized modification
• Implement network intrusion detection for suspicious Ceph protocol anomalies

How to Mitigate CVE-2025-71116

Immediate Actions Required

• Apply the relevant kernel patches from the official Linux kernel stable branches
• Restrict access to Ceph cluster communication channels to trusted systems only
• Monitor systems for signs of exploitation while patching is underway
• Consider temporarily isolating systems with critical Ceph deployments until patches are applied

Patch Information

The Linux kernel maintainers have released patches across multiple stable kernel branches to address this vulnerability. The fix adds explicit bounds checks for each field that is decoded or skipped during OSDMap processing, rather than relying solely on the encoded length value.

Patches are available at the following kernel git commits:

• Kernel Patch 145d140
• Kernel Patch 2acb851
• Kernel Patch 5d0d8c2
• Kernel Patch 8c73851
• Kernel Patch c82e39f
• Kernel Patch d061be4
• Kernel Patch e927ab1

Workarounds

• Implement network-level filtering to restrict Ceph protocol traffic to known trusted sources
• Use firewall rules to limit access to Ceph monitor and OSD communication ports
• Consider disabling the libceph kernel module if Ceph storage functionality is not required
• Deploy network segmentation to isolate Ceph infrastructure from untrusted networks

# Example: Restrict Ceph monitor access using iptables
# Allow only trusted IP ranges to communicate with Ceph monitors
iptables -A INPUT -p tcp --dport 6789 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6789 -j DROP

# Verify libceph module status
lsmod | grep ceph

# If not needed, blacklist the module
echo "blacklist ceph" >> /etc/modprobe.d/blacklist-ceph.conf