In the Linux kernel, the following vulnerability has been resolved:
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
MDSMap export_targets entries are monitor controlled. check_new_map()
uses each entry as a bit number in a fixed stack bitmap, so a rank
outside the protocol namespace can make set_bit() write past the end of
the array.
Reject ranks outside CEPH_MAX_MDS while decoding the map. Do not
validate against possible_max_rank here because maps may legitimately
reference ranks beyond a temporarily reduced max_mds.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - A crafted MDSMap arrives in CEPH_MSG_MDS_MAP over the Ceph messenger TCP session from a monitor or MDS; extra_mon_dispatch() and mds_dispatch() deliver it to ceph_mdsc_handle_mdsmap() on already-mounted CephFS/Rook/Kubernetes clients without a local syscall.
AC:L - The monitor fully controls each export_targets[] u32; after the first map is stored, a later epoch reaches check_new_map() and set_bit() with an attacker-chosen bit number, overflowing the stack bitmap with no race or special layout.
PR:N - The attacker is the remote Ceph monitor or MDS peer and needs no Linux UID, capability, or init-namespace root on the victim, matching other Ceph client decode CVEs such as CVE-2026-68159.
UI:N - Once CephFS is mounted, MDS maps are subscribed and applied automatically in the ceph-msgr worker; a malicious peer can push a new epoch without any further interactive victim action.
S:U - The stack out-of-bounds write corrupts kernel memory on the Ceph client host only and does not cross a VM, IOMMU, or sandbox security authority.
C:H - set_bit() with an attacker-chosen rank writes past the fixed stack bitmap in check_new_map(), corrupting adjacent kernel stack contents; this memory-corruption primitive can be leveraged for information disclosure.
I:H - The overflow is a stack out-of-bounds write of attacker-selected bits at a u32-controlled offset from the targets[] array, enabling control-flow hijack and arbitrary kernel writes.
A:H - An out-of-range bit index makes set_bit() write off the stack object, causing a KASAN stack-out-of-bounds report or kernel oops/panic that a malicious monitor can repeat with each new map epoch.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - A crafted MDSMap arrives in CEPH_MSG_MDS_MAP over the Ceph messenger TCP session from a monitor or MDS; extra_mon_dispatch() and mds_dispatch() deliver it to ceph_mdsc_handle_mdsmap() on already-mounted CephFS/Rook/Kubernetes clients without a local syscall.
AC:L - The monitor fully controls each export_targets[] u32; after the first map is stored, a later epoch reaches check_new_map() and set_bit() with an attacker-chosen bit number, overflowing the stack bitmap with no race or special layout.
PR:N - The attacker is the remote Ceph monitor or MDS peer and needs no Linux UID, capability, or init-namespace root on the victim, matching other Ceph client decode CVEs such as CVE-2026-68159.
UI:N - Once CephFS is mounted, MDS maps are subscribed and applied automatically in the ceph-msgr worker; a malicious peer can push a new epoch without any further interactive victim action.
S:U - The stack out-of-bounds write corrupts kernel memory on the Ceph client host only and does not cross a VM, IOMMU, or sandbox security authority.
C:H - set_bit() with an attacker-chosen rank writes past the fixed stack bitmap in check_new_map(), corrupting adjacent kernel stack contents; this memory-corruption primitive can be leveraged for information disclosure.
I:H - The overflow is a stack out-of-bounds write of attacker-selected bits at a u32-controlled offset from the targets[] array, enabling control-flow hijack and arbitrary kernel writes.
A:H - An out-of-range bit index makes set_bit() write off the stack object, causing a KASAN stack-out-of-bounds report or kernel oops/panic that a malicious monitor can repeat with each new map epoch.
CVSS 3.1