CVE-2025-71116: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71116 is an out-of-bounds read vulnerability in the Linux kernel's libceph subsystem, specifically in the decode_pool() function responsible for parsing OSD map (osdmap) data. If an osdmap is maliciously corrupted such that the encoded length of a ceph_pg_pool envelope is less than expected for a given encoding version, the kernel may perform out-of-bounds memory reads because the only existing bounds check relies on that (attacker-controlled) length value. The vulnerability affects Linux kernel versions from 3.9 through multiple stable branches, including 5.10.x before 5.10.248, 5.11–5.15.x before 5.15.198, 5.16–6.1.x before 6.1.160, 6.2–6.6.x before 6.6.120, 6.7–6.12.x before 6.12.64, 6.13–6.18.x before 6.18.3, and 6.19-rc1 through rc8. It was published on January 14, 2026, with a CVSS v3.1 base score of 7.1 (High) (Feedly, NVD).

The root cause is classified as CWE-125 (Out-of-bounds Read). The decode_pool() function in libceph parses ceph_pg_pool structures from osdmap data received from a Ceph monitor. The function's bounds checking logic trusts the encoded envelope length field; if this field is crafted to be smaller than the actual data structure requires for a given encoding version, subsequent field decoding or skipping operations can read memory beyond the intended buffer boundary. The fix adds explicit per-field bounds checks for every field decoded or skipped within the function, rather than relying solely on the envelope length. Exploitation requires local access with low privileges and the ability to supply or influence a corrupted osdmap to the kernel's Ceph client (NVD, Feedly).

Successful exploitation can result in high confidentiality impact through kernel memory disclosure and high availability impact through system crashes (denial of service). An attacker with local, low-privilege access who can supply a maliciously crafted osdmap may read arbitrary kernel memory contents, potentially exposing sensitive data such as cryptographic keys, credentials, or other in-memory secrets. There is no integrity impact assessed for this vulnerability (Feedly, NVD).

Apply the available kernel patches for the affected stable branches. Fixed versions include: 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.3. Seven upstream kernel commits address this issue: 145d140a, 2acb8517, 5d0d8c29, 8c738512, c82e39ff, d061be4c, and e927ab13 (NVD). For Microsoft Azure Linux 3, apply the kernel patch for version 6.6.119.3-3 (Feedly). Downstream distributions including Debian, Red Hat, AlmaLinux, Oracle Linux, and Amazon Linux 2 have issued their own advisories and updated packages. As a compensating control, restrict local access and limit privilege escalation opportunities on systems running Ceph client workloads.