Bug 2429602 (CVE-2025-71116) - CVE-2025-71116 kernel: libceph: make decode_pool() more resilient against corrupted osdmaps
Summary: CVE-2025-71116 kernel: libceph: make decode_pool() more resilient against cor...
Keywords:
Status: NEW
Alias: CVE-2025-71116
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-01-14 16:03 UTC by OSIDB Bzimport
Modified: 2026-07-06 14:26 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:19568 0 None None None 2026-05-20 12:57:33 UTC
Red Hat Product Errata RHSA-2026:21706 0 None None None 2026-05-28 08:25:52 UTC
Red Hat Product Errata RHSA-2026:21745 0 None None None 2026-05-28 13:26:20 UTC
Red Hat Product Errata RHSA-2026:25218 0 None None None 2026-06-11 10:53:50 UTC
Red Hat Product Errata RHSA-2026:26462 0 None None None 2026-06-17 01:13:52 UTC
Red Hat Product Errata RHSA-2026:26515 0 None None None 2026-06-17 06:33:30 UTC
Red Hat Product Errata RHSA-2026:26563 0 None None None 2026-06-17 11:58:24 UTC
Red Hat Product Errata RHSA-2026:27735 0 None None None 2026-06-22 06:02:05 UTC
Red Hat Product Errata RHSA-2026:33899 0 None None None 2026-07-01 00:15:50 UTC
Red Hat Product Errata RHSA-2026:35896 0 None None None 2026-07-06 14:26:39 UTC

Description OSIDB Bzimport 2026-01-14 16:03:46 UTC 
In the Linux kernel, the following vulnerability has been resolved:

libceph: make decode_pool() more resilient against corrupted osdmaps

If the osdmap is (maliciously) corrupted such that the encoded length
of ceph_pg_pool envelope is less than what is expected for a particular
encoding version, out-of-bounds reads may ensue because the only bounds
check that is there is based on that length value.

This patch adds explicit bounds checks for each field that is decoded
or skipped.
Comment 1 Jon Moroney 2026-01-14 19:34:07 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026011414-CVE-2025-71116-e57d@gregkh/T
Comment 3 errata-xmlrpc 2026-05-20 12:57:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19568 https://access.redhat.com/errata/RHSA-2026:19568
Comment 4 errata-xmlrpc 2026-05-28 08:25:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:21706 https://access.redhat.com/errata/RHSA-2026:21706
Comment 5 errata-xmlrpc 2026-05-28 13:26:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:21745 https://access.redhat.com/errata/RHSA-2026:21745
Comment 6 errata-xmlrpc 2026-06-11 10:53:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:25218 https://access.redhat.com/errata/RHSA-2026:25218
Comment 7 errata-xmlrpc 2026-06-17 01:13:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:26462 https://access.redhat.com/errata/RHSA-2026:26462
Comment 8 errata-xmlrpc 2026-06-17 06:33:29 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:26515 https://access.redhat.com/errata/RHSA-2026:26515
Comment 9 errata-xmlrpc 2026-06-17 11:58:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:26563 https://access.redhat.com/errata/RHSA-2026:26563
Comment 10 errata-xmlrpc 2026-06-22 06:02:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:27735 https://access.redhat.com/errata/RHSA-2026:27735
Comment 11 errata-xmlrpc 2026-07-01 00:15:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:33899 https://access.redhat.com/errata/RHSA-2026:33899
Comment 12 errata-xmlrpc 2026-07-06 14:26:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:35896 https://access.redhat.com/errata/RHSA-2026:35896
Note You need to log in before you can comment on or make changes to this bug.