Executive brief
The Linux kernel's Ceph messenger implementation fails to validate the banner payload length during protocol negotiation. An attacker can send a malformed banner with a zero-length payload, causing the kernel to trigger a warning and potentially destabilizing the connection handling system. This could lead to denial of service in systems relying on Ceph for storage or distributed operations.
Technical details
This is an input validation vulnerability in the Ceph messenger v2 protocol handler (libceph). The `process_banner_prefix()` function in `net/ceph/messenger_v2.c` does not validate that the `payload_len` field from the banner prefix meets the protocol minimum of 16 bytes (required to accommodate two 64-bit integers: `server_feat` and `server_req_feat`). An attacker on the network can craft a banner with `payload_len` set to 0, causing the kernel to attempt a 0-length socket read, which violates an invariant in the state machine and triggers a kernel warning in `populate_in_iter()`. The fix adds validation to reject any `payload_len` smaller than 16 bytes, aborting the connection with a protocol error. This is a network-reachable attack vector requiring no authentication.
Affected products
- Linux Linux kernel all versions (fixed in 2026-09-17 or later)
Timeline
- 2026-09-17: disclosed
- 2026-09-17: advisory: CVE-2026-90067