Executive brief
CephFS is a distributed file system used in Linux environments. When a CephFS mount is re-exported over NFS, a malicious or compromised Ceph metadata server (MDS) can trigger a buffer overflow by sending unusually long filenames, causing memory corruption and potential system crashes or code execution.
Technical details
This is a heap buffer overflow vulnerability in the Linux kernel's Ceph filesystem implementation. The vulnerability exists in the NFS export code path where ceph_get_name() and __get_snap_name() functions copy filenames returned by the Ceph MDS into a fixed-size buffer (NAME_MAX) without validating the length first. An attacker controlling a Ceph MDS can craft a LOOKUPNAME reply with dname_len > NAME_MAX, causing an out-of-bounds write detected by KASAN. The attack is reachable only when a CephFS mount is re-exported over NFS, requiring the attacker to control the MDS. A patch adds the ceph_export_copy_name() function to validate lengths before copying and reject oversized names with -ENAMETOOLONG.
Affected products
- Linux Linux kernel prior to fix commit eff8013c5a8916613c742ae5a2cc341cb605c0ae (affects multiple stable branches from 3.x through 7.x)
Timeline
- 2026-09-11: disclosed: Published on NVD
- 2026-09-07: patched: Fix commit eff8013c5a8916613c742ae5a2cc341cb605c0ae merged into stable branches