GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-68283 (GCVE-0-2025-68283)

Vulnerability from cvelistv5 – Published: 2025-12-16 15:06 – Updated: 2026-08-05 12:10
VLAI
Title
libceph: replace BUG_ON with bounds check for map->max_osd
Summary
In the Linux kernel, the following vulnerability has been resolved: libceph: replace BUG_ON with bounds check for map->max_osd OSD indexes come from untrusted network packets. Boundary checks are added to validate these against map->max_osd. [ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic edits ]
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f24e9980eb860d8600cbe5ef3d2fd9295320d229 , < 57f5fbae9f1024aba17ff75e00433324115c548a (git)
Affected: f24e9980eb860d8600cbe5ef3d2fd9295320d229 , < becc488a4d864db338ebd4e313aa3c77da24b604 (git)
Affected: f24e9980eb860d8600cbe5ef3d2fd9295320d229 , < e67e3be690f5f7e3b031cf29e8d91e6d02a8e30d (git)
Affected: f24e9980eb860d8600cbe5ef3d2fd9295320d229 , < b4368b7f97014e1015445d61abd0b27c4c6e8424 (git)
Affected: f24e9980eb860d8600cbe5ef3d2fd9295320d229 , < ec3797f043756a94ea2d0f106022e14ac4946c02 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.34
Unaffected: 0 , < 2.6.34 (semver)
Unaffected: 6.1.159 , ≤ 6.1.* (semver)
Unaffected: 6.6.119 , ≤ 6.6.* (semver)
Unaffected: 6.12.61 , ≤ 6.12.* (semver)
Unaffected: 6.17.11 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/osdmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "57f5fbae9f1024aba17ff75e00433324115c548a",
              "status": "affected",
              "version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
              "versionType": "git"
            },
            {
              "lessThan": "becc488a4d864db338ebd4e313aa3c77da24b604",
              "status": "affected",
              "version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
              "versionType": "git"
            },
            {
              "lessThan": "e67e3be690f5f7e3b031cf29e8d91e6d02a8e30d",
              "status": "affected",
              "version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
              "versionType": "git"
            },
            {
              "lessThan": "b4368b7f97014e1015445d61abd0b27c4c6e8424",
              "status": "affected",
              "version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
              "versionType": "git"
            },
            {
              "lessThan": "ec3797f043756a94ea2d0f106022e14ac4946c02",
              "status": "affected",
              "version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/osdmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.119",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.119",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.61",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.11",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: replace BUG_ON with bounds check for map-\u003emax_osd\n\nOSD indexes come from untrusted network packets. Boundary checks are\nadded to validate these against map-\u003emax_osd.\n\n[ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic\n  edits ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - An attacker-controlled Ceph monitor or OSD can deliver a crafted CEPH_MSG_OSD_MAP over TCP to an active kernel CephFS or RBD client.\nAC:L - The attacker controls both map-\u003emax_osd and the decoded OSD index, making the BUG_ON reliably reachable without a race or unpredictable condition.\nPR:N - The default legacy messenger monitor path dispatches OSD-map messages before Ceph authentication completes, so an attacker controlling the selected endpoint needs no credentials.\nUI:N - An active Ceph client automatically receives and applies map updates without any user action at exploitation time.\nS:U - The failure occurs within the host kernel and does not cross a separate security authority such as a hypervisor boundary.\nC:N - The BUG_ON executes before the invalid index is used for an out-of-bounds access, providing no information-disclosure primitive.\nI:N - The vulnerable paths terminate at BUG_ON before performing an out-of-bounds write, so the defect does not provide memory corruption or code execution.\nA:H - The crafted index triggers a kernel BUG, which can panic or reboot the host or leave the Ceph workqueue and locked subsystem unusable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:10:36.982Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/57f5fbae9f1024aba17ff75e00433324115c548a"
        },
        {
          "url": "https://git.kernel.org/stable/c/becc488a4d864db338ebd4e313aa3c77da24b604"
        },
        {
          "url": "https://git.kernel.org/stable/c/e67e3be690f5f7e3b031cf29e8d91e6d02a8e30d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4368b7f97014e1015445d61abd0b27c4c6e8424"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec3797f043756a94ea2d0f106022e14ac4946c02"
        }
      ],
      "title": "libceph: replace BUG_ON with bounds check for map-\u003emax_osd",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68283",
    "datePublished": "2025-12-16T15:06:05.355Z",
    "dateReserved": "2025-12-16T14:48:05.291Z",
    "dateUpdated": "2026-08-05T12:10:36.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68283",
      "date": "2026-09-16",
      "epss": "0.00523",
      "percentile": "0.43132"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68283\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T16:16:07.080\",\"lastModified\":\"2026-07-30T06:24:36.080\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlibceph: replace BUG_ON with bounds check for map-\u003emax_osd\\n\\nOSD indexes come from untrusted network packets. Boundary checks are\\nadded to validate these against map-\u003emax_osd.\\n\\n[ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic\\n  edits ]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ceph/osdmap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f24e9980eb860d8600cbe5ef3d2fd9295320d229\",\"lessThan\":\"57f5fbae9f1024aba17ff75e00433324115c548a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f24e9980eb860d8600cbe5ef3d2fd9295320d229\",\"lessThan\":\"becc488a4d864db338ebd4e313aa3c77da24b604\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f24e9980eb860d8600cbe5ef3d2fd9295320d229\",\"lessThan\":\"e67e3be690f5f7e3b031cf29e8d91e6d02a8e30d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f24e9980eb860d8600cbe5ef3d2fd9295320d229\",\"lessThan\":\"b4368b7f97014e1015445d61abd0b27c4c6e8424\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f24e9980eb860d8600cbe5ef3d2fd9295320d229\",\"lessThan\":\"ec3797f043756a94ea2d0f106022e14ac4946c02\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ceph/osdmap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.34\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.34\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.159\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.119\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.61\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.11\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/57f5fbae9f1024aba17ff75e00433324115c548a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b4368b7f97014e1015445d61abd0b27c4c6e8424\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/becc488a4d864db338ebd4e313aa3c77da24b604\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e67e3be690f5f7e3b031cf29e8d91e6d02a8e30d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ec3797f043756a94ea2d0f106022e14ac4946c02\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:34:00+00:00",
      "cve": "CVE-2025-68283",
      "id": "CVE-2025-68283",
      "initial_release_date": "2025-12-16T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: libceph: replace BUG_ON with bounds check for map-\u003emax_osd",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68283.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T16:35:13Z",
      "cve": "CVE-2025-68283",
      "id": "CVE-2025-68283",
      "initial_release_date": "2025-12-20T00:26:05Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "807",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "317",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68283",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68283.json",
      "version": "40"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.