Executive brief
The Linux kernel's Ceph filesystem driver contains a buffer overflow vulnerability in the metadata server map (mdsmap) decoding logic. An attacker who can control Ceph monitor responses could craft malicious mdsmap data with out-of-bounds rank values that cause the kernel to write past the end of a fixed-size stack buffer, leading to kernel crash, memory corruption, or potential code execution on systems using Ceph storage.
Technical details
A buffer overflow exists in fs/ceph/mdsmap.c during mdsmap decoding when processing export_targets rank values. The vulnerable code uses export_targets entries as bit indices in a fixed-size stack bitmap via set_bit(), but does not validate that rank values stay within CEPH_MAX_MDS bounds. An attacker controlling the Ceph monitor can send a crafted MDSMap with rank values >= CEPH_MAX_MDS, causing set_bit() to write past the bitmap's array boundary. The attack requires network access to inject malicious Ceph protocol messages. The fix adds a bounds check to reject ranks outside CEPH_MAX_MDS during map decoding, with patches available in the Linux stable kernel trees.
Affected products
- Linux Linux kernel multiple versions (see stable tree references)
Timeline
- 2026-09-11: disclosed: CVE-2026-89653 published
- 2026-09-14: patched: Fix committed to stable kernel trees by Greg Kroah-Hartman