CVE-2025-71116
A critical flaw in the Linux kernel’s libceph component can let attackers read beyond intended memory boundaries when processing corrupted OSD maps. The issue has been fixed in a kernel patch that adds bounds checks.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, including versions 3.9 and 6.19 and later, on any system that runs Ceph with libceph. Typical users are administrators of Linux-based Ceph storage clusters.
Real-world impact
An attacker could read sensitive data from memory, potentially exposing confidential information or system state.
Why this severity
The CVSS score of 9.1 reflects that the flaw can be exploited remotely without authentication, with no user interaction, and can lead to complete data disclosure.
What to do about it
- 01Update the Linux kernel to a version that includes the libceph decode_pool patch.
- 02Reboot or reload the kernel to activate the updated kernel.
NVD-referenced vendor advisory
Timeline
- Jan 14, 2026 · Jan 14, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 6d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/145d140abda80e3333…patch
- git.kernel.org/stable/c/2acb8517429ab42146…patch
- git.kernel.org/stable/c/5d0d8c292531fe356c…patch
- git.kernel.org/stable/c/8c738512714e8c0aa1…patch
- git.kernel.org/stable/c/c82e39ff67353a5a6c…patch
- git.kernel.org/stable/c/d061be4c8040ffb111…patch
- git.kernel.org/stable/c/e927ab132b87ba3f07…patch