Executive brief
The Ceph distributed storage system's Linux kernel driver failed to validate the number of delegated inode intervals received from the Ceph metadata server (MDS). A malicious or compromised MDS could send specially crafted messages causing the client to spin in an unbounded loop or exhaust memory, leading to denial of service and potential system instability.
Technical details
The vulnerability exists in ceph_parse_deleg_inos(), which decodes delegated inode numbers from MDS create-with-delegation replies. The function reads attacker-controlled 64-bit length values using ceph_decode_64_safe() without validating the actual value, allowing a malicious MDS to specify arbitrary interval lengths or quantities. An attacker could cause unbounded loop execution during insertion into the session's delegated-inode xarray and unbounded memory consumption. The fix implements per-session atomic counters capped at CEPH_MAX_DELEG_INOS and per-reply interval length limits enforced through atomic_add_unless(). Network access to a Ceph MDS is required; the vulnerability does not require user interaction or authentication beyond normal Ceph cluster participation.
Affected products
- Linux Linux kernel versions prior to the fix (CVE-2026-89648 fix)
Timeline
- 2026-09-11: disclosed