The Linux kernel's Ceph client code in net/ceph/osd_client.c (osd_sparse_read()) validated that the sparse-read data length matched the summed extent lengths but did not verify that each OSD-supplied extent was monotonic and within the original request range. This allowed a malicious authenticated OSD to advertise a far-forward nonzero extent offset with matching data length, causing the client to advance the message-data cursor beyond the request buffer. This leads to a BUG_ON(!*length) assertion failure in ceph_msg_data_next() during client message receive processing, resulting in a kernel crash. The vulnerability was fixed by adding checks to reject sparse extent maps that overflow, move backwards, overlap, or extend outside the original sparse-read request before advancing the cursor.

A malicious or compromised authenticated Ceph OSD peer can cause a kernel crash on the Ceph client by sending a malformed sparse-read reply. This results in a denial of service condition for the affected client system.

A fix has been implemented in the Linux kernel to validate sparse extent maps earlier in the processing flow, rejecting any that overflow, move backwards, overlap, or extend outside the original request range before advancing the cursor. Users should apply the official kernel updates that include this fix. No additional mitigations are indicated by the vendor advisory.