CVE-2026-89649: Linux Kernel CephFS Information Disclosure

CVE-2026-89649 Overview

CVE-2026-89649 is an out-of-bounds read vulnerability in the Linux kernel's CephFS client. The flaw resides in __build_xattrs(), which decodes extended attribute (xattr) blobs supplied by a Ceph Metadata Server (MDS). The function fails to bound-check the value length of the final attribute in the blob. A malicious or compromised MDS can craft a blob whose last attribute declares a value length larger than the allocation, causing a subsequent getxattr(2) call to copy adjacent kernel heap memory into a user-controlled buffer.

Critical Impact
A malicious CephFS metadata server can disclose adjacent kernel heap memory to any local user with access to a CephFS mount, leaking sensitive kernel data.

Affected Products

Linux kernel CephFS client (fs/ceph)
Multiple stable kernel branches prior to the fix commits
Systems mounting CephFS filesystems from untrusted or compromised MDS instances

Discovery Timeline

2026-09-11 - CVE-2026-89649 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89649

Vulnerability Analysis

The __build_xattrs() function in the CephFS client parses an xattr blob delivered by the MDS one attribute at a time. Each attribute consists of a 32-bit name length, the name bytes, a 32-bit value length, and the value bytes. Both length fields are read using ceph_decode_32_safe(), which validates that the length field itself fits in the remaining blob.

After reading the value length, the parser advances the buffer pointer with a bare p += len operation. No corresponding ceph_decode_need() call verifies that len bytes actually remain in the blob. For non-terminal attributes this omission is masked, because the next iteration's ceph_decode_32_safe() call on the following name length implicitly validates the prior advance. The last attribute has no successor, so its declared value length is never bounded against the blob end.

The blob is a dedicated kvmalloc() allocation sized to the wire length by ceph_buffer_new() in ceph_fill_inode(). __set_xattr() records the attacker-controlled val_len verbatim into the in-memory xattr structure. A later getxattr(2) syscall performs memcpy(value, xattr->val, xattr->val_len) into the user buffer, copying bytes beyond the allocation back to user space.

Root Cause

The root cause is a missing bounds check [CWE-125 Out-of-Bounds Read]. The decoder trusts the MDS-supplied 32-bit value length for the terminal attribute and stores it without validating that the declared bytes exist inside the blob allocation.

Attack Vector

Exploitation requires a malicious or compromised Ceph Metadata Server that can return crafted xattr blobs for inodes accessed by the target client. Any local user on the client with permission to invoke getxattr(2) on a CephFS file triggers the copy. The result is disclosure of kernel heap memory adjacent to the xattr allocation. See the upstream fix commits referenced under Kernel Commit 1dd3563 and Kernel Commit 68d5417 for the technical patch details.

Detection Methods for CVE-2026-89649

Indicators of Compromise

Unexpected -EIO errors from getxattr(2) on CephFS mounts after applying the patch, indicating an MDS returned a malformed xattr blob.
CephFS mounts pointing to MDS endpoints outside the organization's trust boundary.
Kernel log entries from the ceph subsystem reporting xattr decode failures.

Detection Strategies

Audit running kernel versions across Linux fleets and compare against fixed stable releases referenced in the upstream commits.
Monitor syscall telemetry for anomalous getxattr patterns from unprivileged processes against CephFS-mounted paths.
Correlate CephFS client kernel messages with MDS session establishment events to identify untrusted or newly connected metadata servers.

Monitoring Recommendations

Enable auditd rules covering getxattr, lgetxattr, and fgetxattr on CephFS mount points.
Ingest kernel ring buffer (dmesg) output into a centralized log platform and alert on ceph: decode errors.
Track MDS session identifiers and reject clients from connecting to metadata servers that are not on an approved allowlist.

How to Mitigate CVE-2026-89649

Immediate Actions Required

Update Linux kernels on all CephFS client hosts to a version containing the upstream fix commits.
Restrict CephFS mounts to metadata servers operated inside the organization's trust boundary.
Limit local user access on hosts that mount CephFS from shared or multi-tenant clusters.

Patch Information

The fix adds the missing ceph_decode_need() call so that an out-of-bounds value length on the final attribute causes the decoder to fail with -EIO rather than storing the oversized length. Backports are available across multiple stable branches. See the upstream patches: Kernel Commit 01e3f19, Kernel Commit 1dd3563, Kernel Commit 38be2f3, Kernel Commit 61f085c, Kernel Commit 68d5417, Kernel Commit 848b80c, Kernel Commit b12b332, and Kernel Commit cb0cd79.

Workarounds

Unmount CephFS filesystems on hosts that cannot be patched immediately.
Deny local shell access on CephFS client systems to prevent invocation of getxattr(2) by untrusted users.
Enforce mutual authentication and network segmentation between CephFS clients and MDS instances so that only trusted metadata servers can serve xattr blobs.