Executive brief
The Linux kernel contains a buffer over-read vulnerability in the Ceph network filesystem client's message handler. A malicious or compromised Ceph metadata server can force the client kernel to read up to 4 GB beyond the message buffer during session initialization, causing the client system to crash. This occurs with no user interaction and happens automatically during the mount process.
Technical details
The vulnerability is a missing bounds check in the handle_session() function when decoding MDSCapAuth records from CEPH_SESSION_OPEN messages (version 6+). The code copies match.path and match.fs_name byte strings using ceph_decode_copy() without first performing ceph_decode_need() bounds validation, unlike surrounding fields. This allows a length field larger than remaining message bytes to trigger an out-of-bounds read past the end of the message front buffer (a dedicated kvmalloc allocation). The attack vector is network-based: any malicious or compromised MDS can send a crafted message on the first post-connect session setup with no client-side authentication or user interaction required. The fix switches to ceph_decode_copy_safe(), which enforces bounds checking before copying.
Affected products
- Linux Linux kernel msg_version >= 6 in Ceph subsystem (affected versions not specified in advisory)
Timeline
- 2026-09-11: disclosed: CVE-2026-89651 published