A vulnerability in the Linux kernel libceph module allows a compromised OSD peer to cause a denial of service by crashing the kernel client.

The issue exists in the osd_sparse_read function within net/ceph/osd_client.c, where insufficient validation of OSD-supplied extent maps allows an authenticated OSD peer to force a client to advance its message-data cursor beyond the request buffer, triggering a BUG_ON assertion.

The primary impact of this vulnerability is a denial of service, as a malicious OSD can crash the kernel Ceph client. While the CVSS score of 7.5 indicates a high severity based on the potential for service disruption, the requirement for an authenticated OSD peer limits the attack surface. However, in environments where OSD trust boundaries are compromised, this could lead to significant operational instability and downtime for storage-dependent services.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or a later stable release where this issue has been resolved.

Proactive Monitoring: Monitor system logs for kernel panics, BUG_ON assertion triggers, or abnormal network traffic patterns between Ceph clients and OSD nodes.

Compensating Controls: Ensure that network traffic between Ceph components is restricted to authorized nodes and implement strict authentication mechanisms for OSD communications to prevent unauthorized peers from interacting with the client.

Public Exploit Available: No

This vulnerability presents a clear risk to the stability of Ceph storage environments. Organizations running Linux kernel versions affected by this flaw should prioritize testing and deploying the identified security patches. Failure to update may leave production systems susceptible to remote crashes initiated by a compromised or malicious peer within the storage cluster.