Loading vulnerability…
Out-of-bounds read in Linux kernel libceph decode_pool()
CVE-2025-71116 is an out-of-bounds read vulnerability in the Linux kernel's libceph decode_pool() function. A corrupted or maliciously crafted Ceph OSD map can specify a ceph_pg_pool envelope length smaller than required by its encoding version. Because decoding relies on this encoded length without independently checking each decoded or skipped field, the parser can read beyond valid bounds. A server-side Ceph OSD or monitor can deliver the malformed map to a kernel client over an authenticated Ceph connection, potentially causing information disclosure or a kernel crash.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can crash the client kernel and cause denial of service. Out-of-bounds reads may also disclose memory contents, potentially including cryptographic keys, personal information, or memory addresses useful for bypassing ASLR. Arbitrary code execution and privilege escalation are not established. Currently supported F5 products are not affected; products past End of Technical Support were not evaluated.
If you can’t patch tonight, do this now.
If Ceph is not used, prevent the libceph kernel module from loading by blacklisting it. Where Ceph is required, connect clients only to trusted clusters and monitors, restrict access to monitor and OSD services to trusted hosts, and avoid untrusted OSD-map inputs. These exposure controls do not eliminate the risk posed by a compromised or malfunctioning authorized Ceph node.
Patch, then assume compromise.
Install a distribution kernel update containing the decode_pool() fix, which adds explicit bounds checks for every decoded or skipped field, and reboot into the updated kernel. Fixed Debian releases include linux 6.12.69-1 or later for trixie and 6.1.162-1 for bookworm. Examples of fixed RHEL kernel releases include 5.14.0-570.120.1.el9_6 for RHEL 9.6, 5.14.0-427.132.1.el9_4 for RHEL 9.4, 4.18.0-553.126.1.el8_10 for RHEL 8.10, and 6.12.0-55.95.1.el10_0 for RHEL 10.0 Extended Update Support. Use the update appropriate to the installed product and support stream. Backporting the upstream per-field bounds-checking patch is an alternative for maintained custom kernels.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.