In the Linux kernel, the following vulnerability has been resolved:

ceph: reject export targets ranks >= CEPH MAX MDS in mdsmap decode

MDSMap export targets entries are monitor controlled. check new map() uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can make set bit() write past the end of the array.

Reject ranks outside CEPH MAX MDS while decoding the map. Do not validate against possible max rank here because maps may legitimately reference ranks beyond a temporarily reduced max mds.