CVE-2025-71116

Medium

Elevated severity or exploit probability.

CVSS base

9.1 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS — probability of exploitation (30 days)

0.4%

30.8th percentile

CISA KEV

Not listed

Weakness / dates

CWE-125

Published 2026-01-14 · modified 2026-07-30

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector	N	Network
Attack Complexity	L	Low
Privileges Required	N	None
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	H	High
Integrity	N	None
Availability	H	High

Timeline

2026-01-14 — Published (NVD)
2026-07-30 — Last modified (NVD)

Description

In the Linux kernel, the following vulnerability has been resolved: libceph: make decode_pool() more resilient against corrupted osdmaps If the osdmap is (maliciously) corrupted such that the encoded length of ceph_pg_pool envelope is less than what is expected for a particular encoding version, out-of-bounds reads may ensue because the only bounds check that is there is based on that length value. This patch adds explicit bounds checks for each field that is decoded or skipped.

Affected

linux

References

Official: NVD · CVE.org