Linux kernel libceph OOB read: primary_temp index validation patch

Linux Kernel Vulnerability Summary Vulnerability Overview Vulnerability Name: libceph: Avoid using invalid oids from primary_temp Problem Description: Corrupted osdmap instances received from ceph monitors or OSDs can contain invalid indices (greater than max_osd or less than 0) in arrays such as , , and . These indices are used to populate the array; if the indices are out of bounds, it results in an out-of-bounds access. Trigger Scenario: When is called, if the indices in are invalid, the function falls back to using the array. However, the array itself may also contain invalid indices, leading to an out-of-bounds read. Impact Scope Affected File: Affected Function: Risk: Out-of-bounds read, which may lead to a kernel crash or information leakage. Fix Details Remediation Approach: Add validation checks for indices within to ensure the indices fall within the range . Commit Information: - Author: Raghav Zinner - Committer: Greg Kroah-Hartman - Date: 2026-07-20 - Patch: branch POC / Fix Code ```c / primary_temp / if (pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->osdmap->primary_temp_pgid] && pg_upmap[pg_map->os

Goal Reached Thanks to every supporter — we hit 100%!

Linux kernel libceph OOB read: primary_temp index validation patch

More from this source