CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd
In the Linux kernel, the following vulnerability has been resolved:
libceph: replace BUGON with bounds check for map->maxosd
OSD indexes come from untrusted network packets. Boundary checks are added to validate these against map->maxosd.
[ idryomov: drop BUGON in cephgetprimaryaffinity(), minor cosmetic edits ]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the Linux kernel, update ceph_get_primary_affinity() (libceph) to replace the BUG_ON with a bounds check validating OSD indexes from untrusted network packets against map->max_osd.
Linux kernel Replace BUG_ON with bounds check in ceph_get_primary_affinity() for OSD indexes against map->max_osd = bounds check against map->max_osd instead of BUG_ON
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68283?
CVE-2025-68283 has a high severity due to its potential impact on the integrity of the Linux kernel.
How do I fix CVE-2025-68283?
To fix CVE-2025-68283, update the Linux kernel to the latest version that includes the bounds check for map->max_osd.
What does CVE-2025-68283 affect?
CVE-2025-68283 affects the Linux kernel and specifically impacts the handling of OSD indexes from untrusted network packets.
When was CVE-2025-68283 reported?
CVE-2025-68283 was reported in 2025 after the discovery of boundary issues in the libceph functionality of the Linux kernel.
Who is affected by CVE-2025-68283?
Users of the Linux kernel who utilize the libceph module for Ceph storage solutions may be affected by CVE-2025-68283.