CVE-2026-89648: Linux Kernel Ceph DOS Vulnerability

CVE-2026-89648 Overview

CVE-2026-89648 affects the Linux kernel Ceph client, specifically the ceph_parse_deleg_inos() function that decodes delegated inode interval sets from Metadata Server (MDS) create-with-delegation replies. The function reads attacker-controlled 64-bit length values without bounds validation, then loops over that length while inserting entries into the session's delegated inode xarray. A malicious or compromised MDS can send oversized intervals, many intervals per reply, or repeated replies to spin the insertion loop or exhaust client memory. The fix introduces a per-session atomic counter capped at CEPH_MAX_DELEG_INOS and also bounds the aggregate interval length accepted per reply.

Critical Impact
A malicious or compromised Ceph MDS can exhaust CPU cycles and kernel memory on connected Linux clients, causing denial of service through unbounded loop iteration and unrestricted xarray growth.

Affected Products

Linux kernel Ceph filesystem client (fs/ceph)
Systems mounting CephFS from untrusted or compromised MDS instances
Distributions shipping vulnerable versions of the mainline Linux kernel

Discovery Timeline

2026-09-11 - CVE-2026-89648 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89648

Vulnerability Analysis

The flaw resides in the Ceph client's handling of MDS create-with-delegation replies. ceph_parse_deleg_inos() decodes interval sets describing ranges of inode numbers the MDS delegates to the client for asynchronous file creation. For each interval, the function reads a 64-bit start and 64-bit len using ceph_decode_64_safe(), which verifies message length but not value sanity.

The function then iterates len times, calling ceph_insert_deleg_ino() to populate the session's s_delegated_inosxarray. Because len originates from the MDS wire message, an attacker controlling the server can supply arbitrary values. This constitutes a resource exhaustion vulnerability rooted in missing input validation on network-supplied length fields.

Root Cause

The root cause is the absence of upper bounds on interval length values and on the aggregate delegated inode population per session. Neither per-interval size, per-reply interval count, nor cumulative population across replies was validated. Duplicate intervals within a single reply could also spin the insertion loop without growing the xarray, bypassing any population-based check alone.

Attack Vector

A malicious or compromised MDS transmits a crafted create-with-delegation reply containing one very large interval, many intervals, duplicated ranges, or repeated replies accumulating on the same session. The client kernel spins in the insertion loop consuming CPU, or grows the delegated inode xarray until memory is exhausted. Exploitation requires network reachability to the client and control over the MDS, but requires no authentication of the client user and no user interaction.

No code example is provided because no verified public proof-of-concept exists. Technical details are available in the upstream kernel commits: 4bd3158bd624, c040e139f1a6, and f341270ac5f5.

Detection Methods for CVE-2026-89648

Indicators of Compromise

Sustained high kernel CPU utilization on hosts with active CephFS mounts, particularly in softirq or message-processing contexts
Unexplained growth in kernel slab memory associated with xarray allocations tied to Ceph session state
Client-side hangs or unresponsiveness during file creation operations against a CephFS mount
MDS log entries showing anomalous or malformed delegation reply patterns from a peer server

Detection Strategies

Monitor kernel version inventory for hosts running Linux kernels predating the fix commits referenced above
Correlate CephFS mount events with performance regressions in endpoint telemetry
Inspect Ceph cluster health and MDS process integrity for signs of compromise upstream of the client

Monitoring Recommendations

Track memory pressure and CPU spikes on CephFS client nodes with time-series metrics
Alert on unexpected kernel panics, OOM kills, or soft-lockup warnings referencing ceph_parse_deleg_inos or ceph_insert_deleg_ino in dmesg
Audit trust boundaries between clients and MDS instances, treating unauthenticated or cross-tenant MDS servers as untrusted

How to Mitigate CVE-2026-89648

Immediate Actions Required

Identify all Linux hosts mounting CephFS and inventory their kernel versions
Apply distribution-provided kernel updates that include the three referenced upstream commits
Restrict client connectivity to MDS instances under the same administrative trust boundary
Review Ceph cluster access controls and rotate any credentials suspected of exposure

Patch Information

The upstream fix bounds both dimensions of the attack. A per-session atomic counter tracks the number of delegated inodes and uses atomic_add_unless() inside ceph_insert_deleg_ino() to refuse pushing the count past CEPH_MAX_DELEG_INOS. The aggregate interval length accepted from a single reply is separately capped to prevent loop spinning on duplicate ranges. Apply the fixes committed in 4bd3158bd624, c040e139f1a6, and f341270ac5f5.

Workarounds

Unmount CephFS filesystems on hosts that cannot be patched immediately if the MDS trust posture is uncertain
Enforce network segmentation isolating CephFS clients from any MDS not under direct administrative control
Harden MDS hosts to reduce the risk of upstream compromise that could be leveraged against clients

bash

# Verify running kernel version and check for CephFS mounts
uname -r
mount -t ceph

# Temporarily unmount CephFS if patching is delayed and MDS trust is uncertain
umount -f /mnt/cephfs