Description

In the Linux kernel, the following vulnerability has been resolved: ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode MDSMap export_targets entries are monitor controlled. check_new_map() uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can make set_bit() write past the end of the array. Reject ranks outside CEPH_MAX_MDS while decoding the map. Do not validate against possible_max_rank here because maps may legitimately reference ranks beyond a temporarily reduced max_mds.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:51.400Z",
  "pubdate": "2026-09-11T20:19:51.400Z",
  "executiveSummary": "A vulnerability in the Linux kernel Ceph file system client allows for an out-of-bounds memory access during MDSMap decoding. The issue stems from insufficient validation of export_targets ranks provided by the monitor. By injecting a rank value exceeding the CEPH_MAX_MDS constant, an attacker can trigger a heap-based buffer overflow via set_bit operations on a fixed-size stack bitmap. This vulnerability impacts systems utilizing the Ceph kernel client, posing a risk of memory corruption, kernel panic, or potential code execution scenarios. Exploitation requires an attacker to exert influence or control over the Ceph monitor, as the malicious MDSMap must be transmitted to the client during a map update. The vulnerability highlights the dangers of trusting monitor-controlled inputs without strict bounds checking against kernel-defined protocol limits.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper validation of the export_targets field within the MDSMap decoding process in the Linux kernel's Ceph client implementation. When the Ceph monitor sends an MDSMap update to the client, the kernel decodes the map and populates internal structures. The export_targets array is intended to track MDS ranks involved in migration or subtree delegation. However, the decoding logic fails to ensure that these ranks remain within the defined boundary of CEPH_MAX_MDS.\nSpecifically, the function check_new_map() utilizes each received export_target rank as an index for a set_bit() operation against a fixed-size bitmap allocated on the stack. Because the index is not checked against the maximum possible number of supported MDS ranks (CEPH_MAX_MDS), a malicious or malformed MDSMap can provide an arbitrary integer value as a rank. When set_bit() is invoked with this out-of-range index, it performs a write operation into memory locations outside the allocated bitmap buffer.\nThe attack flow proceeds as follows: 1) An attacker compromises or impersonates a Ceph monitor to control the MDSMap disseminated to clients. 2) The attacker constructs a malicious MDSMap containing an export_target value equal to or greater than CEPH_MAX_MDS. 3) The target client receives this update and initiates the decoding process. 4) During decoding, the kernel enters check_new_map(), where the unsanitized rank is passed directly to set_bit(). 5) The set_bit() function interprets the high rank as an offset, resulting in a write operation that corrupts adjacent kernel stack memory.\nThe impact of this corruption is severe, potentially leading to immediate kernel instability (panic) or the modification of sensitive stack data, such as return addresses or function pointers, which could facilitate arbitrary code execution under specific circumstances. The vulnerability is particularly dangerous because it bypasses architectural assumptions regarding the maximum rank size. It is critical to note that validation must be performed against the static CEPH_MAX_MDS constant rather than a dynamic variable like possible_max_rank, as the latter can be temporarily reduced during cluster rebalancing, which would incorrectly reject legitimate map data. By enforcing strict validation against CEPH_MAX_MDS during the initial decoding phase, the kernel ensures that subsequent bitmap operations remain confined to the designated memory region, effectively neutralizing the buffer overflow vector."
}