---
id: CVE-2025-71116
title: 'libceph: make decode_pool() more resilient against corrupted osdmaps'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  libceph: make decode_pool() more resilient against corrupted osdmaps

  If the osdmap is (maliciously) corrupted such that the encoded length
  of ceph_pg_pool envelope is …
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4f6a7e5ee1393ec4b243b39dac9f36992d161540 <
    d061be4c8040ffb1110d537654a038b8b6ad39d2
  - >-
    Linux >= 4f6a7e5ee1393ec4b243b39dac9f36992d161540 <
    145d140abda80e33331c5781d6603014fa75d258
  - >-
    Linux >= 4f6a7e5ee1393ec4b243b39dac9f36992d161540 <
    c82e39ff67353a5a6cbc07b786b8690bd2c45aaa
  - >-
    Linux >= 4f6a7e5ee1393ec4b243b39dac9f36992d161540 <
    e927ab132b87ba3f076705fc2684d94b24201ed1
  - >-
    Linux >= 4f6a7e5ee1393ec4b243b39dac9f36992d161540 <
    5d0d8c292531fe356c4e94dcfdf7d7212aca9957
  - >-
    Linux >= 4f6a7e5ee1393ec4b243b39dac9f36992d161540 <
    2acb8517429ab42146c6c0ac1daed1f03d2fd125
  - >-
    Linux >= 4f6a7e5ee1393ec4b243b39dac9f36992d161540 <
    8c738512714e8c0aa18f8a10c072d5b01c83db39
  - Linux 3.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-10T20:42:27.725166Z'
published: '2026-01-14'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:15:14.284Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71116'
references:
  - url: 'https://git.kernel.org/stable/c/d061be4c8040ffb1110d537654a038b8b6ad39d2'
  - url: 'https://git.kernel.org/stable/c/145d140abda80e33331c5781d6603014fa75d258'
  - url: 'https://git.kernel.org/stable/c/c82e39ff67353a5a6cbc07b786b8690bd2c45aaa'
  - url: 'https://git.kernel.org/stable/c/e927ab132b87ba3f076705fc2684d94b24201ed1'
  - url: 'https://git.kernel.org/stable/c/5d0d8c292531fe356c4e94dcfdf7d7212aca9957'
  - url: 'https://git.kernel.org/stable/c/2acb8517429ab42146c6c0ac1daed1f03d2fd125'
  - url: 'https://git.kernel.org/stable/c/8c738512714e8c0aa18f8a10c072d5b01c83db39'
tags:
  - cve.org
epss: 0.00378
epssPercentile: 0.30307
ingestedAt: '2026-10-19T18:35:50.132Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

libceph: make decode_pool() more resilient against corrupted osdmaps

If the osdmap is (maliciously) corrupted such that the encoded length
of ceph_pg_pool envelope is less than what is expected for a particular
encoding version, out-of-bounds reads may ensue because the only bounds
check that is there is based on that length value.

This patch adds explicit bounds checks for each field that is decoded
or skipped.

## Affected

- `Linux >= 4f6a7e5ee1393ec4b243b39dac9f36992d161540 < d061be4c8040ffb1110d537654a038b8b6ad39d2`
- `Linux >= 4f6a7e5ee1393ec4b243b39dac9f36992d161540 < 145d140abda80e33331c5781d6603014fa75d258`
- `Linux >= 4f6a7e5ee1393ec4b243b39dac9f36992d161540 < c82e39ff67353a5a6cbc07b786b8690bd2c45aaa`
- `Linux >= 4f6a7e5ee1393ec4b243b39dac9f36992d161540 < e927ab132b87ba3f076705fc2684d94b24201ed1`
- `Linux >= 4f6a7e5ee1393ec4b243b39dac9f36992d161540 < 5d0d8c292531fe356c4e94dcfdf7d7212aca9957`
- `Linux >= 4f6a7e5ee1393ec4b243b39dac9f36992d161540 < 2acb8517429ab42146c6c0ac1daed1f03d2fd125`
- `Linux >= 4f6a7e5ee1393ec4b243b39dac9f36992d161540 < 8c738512714e8c0aa18f8a10c072d5b01c83db39`
- `Linux 3.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.