Riskcovery

CVE-2025-68283

libceph: replace BUG_ON with bounds check for map->max_osd

State
Published
Severity
7.5 High
Published
Dec 16, 2025
Updated
Oct 15, 2026
Reserved
Dec 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

libceph: replace BUG_ON with bounds check for map->max_osd

OSD indexes come from untrusted network packets. Boundary checks are added to validate these against map->max_osd.

[ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic edits ]

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before 57f5fbae9f1024aba17ff75e00433324115c548aAffected
  • f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before becc488a4d864db338ebd4e313aa3c77da24b604Affected
  • f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before e67e3be690f5f7e3b031cf29e8d91e6d02a8e30dAffected
  • f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before b4368b7f97014e1015445d61abd0b27c4c6e8424Affected
  • f24e9980eb860d8600cbe5ef3d2fd9295320d229 to before ec3797f043756a94ea2d0f106022e14ac4946c02Affected
LinuxLinux
  • 2.6.34Affected
  • before 2.6.34Not affected
  • 6.1.159 through 6.1.*Not affected
  • 6.6.119 through 6.6.*Not affected
  • 6.12.61 through 6.12.*Not affected
  • 6.17.11 through 6.17.*Not affected
  • 6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.