HIGH
ceph OSDMap DoS
CVE-2026-22990
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is no need to BUG. Instead, just declare the incremental osdmap to be invalid.
02KernelScan AI Analysis
Risk summary
An attacker who can send malformed Ceph OSD map data to a vulnerable system can cause an immediate kernel panic, resulting in system downtime and denial of service. This is particularly concerning in distributed storage environments where availability is critical.
Vulnerability analysis
Summary: The libceph OSD map processing code contains an overzealous BUG_ON() assertion that can be triggered by maliciously crafted or corrupted incremental OSD map data, causing a kernel panic and denial of service.
Root Cause: The original code used BUG_ON(epoch != map->epoch+1) to validate that incremental OSD map epochs are sequential. However, BUG_ON() causes an immediate kernel panic, which is inappropriate for handling potentially malicious input data that could come from untrusted network sources.
Attack Surface: This vulnerability affects systems using Ceph distributed storage that process OSD map updates from potentially untrusted sources. The attack surface includes network-facing Ceph clients and servers that handle incremental OSD map data, which could be maliciously crafted to trigger the assertion failure.
Fix Mechanism: The patch replaces the BUG_ON() assertion with a conditional check that gracefully handles epoch mismatches by jumping to the error handling path (e_inval), which marks the incremental OSD map as invalid without crashing the kernel.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 5.10 | 5.10.248 | 9aa0b0c14cef |
| 5.15 | 5.15.198 | 4b106fbb1c7b |
| 6.1 | 6.1.161 | 6afd2a421352 |
| 6.12 | 6.12.66 | 6c6cec3db3b4 |
| 6.18 | 6.18.6 | 6348d70af847 |
| 6.6 | 6.6.121 | d3613770e267 |
| mainline | 6.19 | e00c3f71b5cf |