CVE-2026-89650: Linux Kernel CephFS Use-After-Free Vulnerability

CVE-2026-89650 Overview

CVE-2026-89650 is an out-of-bounds read vulnerability in the Linux kernel's CephFS client, specifically in the ceph_mdsmap_decode() function located in fs/ceph/mdsmap.c. The function reads the num_export_targets field from each per-mds info record and advances the decode cursor by num_export_targets * sizeof(u32) without verifying that many bytes remain in the buffer. The bounds check that would catch a runaway cursor is gated on info_v >= 4, leaving info versions 2 and 3 unprotected. A malicious or compromised Ceph monitor, or an on-path attacker on an unsigned messenger session, can send a crafted MDS map to trigger the flaw in the client kernel.

Critical Impact
A malicious Ceph monitor can trigger an out-of-bounds kernel read in the CephFS client by sending an MDS map with an oversized num_export_targets, potentially leading to kernel memory corruption or denial of service.

Affected Products

Linux kernel CephFS client (fs/ceph/mdsmap.c)
Ceph messenger subsystem processing CEPH_MSG_MDS_MAP messages
Kernel builds prior to the patched stable releases referenced in the linked kernel commits

Discovery Timeline

2026-09-11 - CVE-2026-89650 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89650

Vulnerability Analysis

The flaw resides in ceph_mdsmap_decode(), which parses MDS map messages received from a Ceph monitor. For each per-mds info record, the function reads a 32-bit num_export_targets value and advances the decode cursor by that count multiplied by sizeof(u32). The upper-bound safety check (*p > info_end) only executes when info_v >= 4, because info_end is left NULL for info versions 2 and 3. When the cursor moves past the front buffer, the subsequent export-targets loop invokes ceph_decode_32() against out-of-bounds memory. On x86_64 with KASAN enabled, the condition is reported as a slab-out-of-bounds read inside ceph_mdsmap_decode(). The decoded values are stored in the internal info->export_targets[] array, so the immediate consequence is a kernel out-of-bounds read rather than an information leak to a remote attacker.

Root Cause

The root cause is missing input validation on an attacker-controlled length field. The kernel trusts num_export_targets from the wire without calling ceph_decode_need() before advancing the cursor for info versions 2 and 3. Additionally, the multiplication num_export_targets * sizeof(u32) is performed without overflow-safe arithmetic such as size_mul(), meaning a large value can wrap the computed byte count and bypass later kcalloc() guards.

Attack Vector

A kernel client processes CEPH_MSG_MDS_MAP from its monitor session. The net/ceph/mon_client.c dispatcher routes the message to ceph_mdsc_handle_mdsmap() in fs/ceph/super.c, which calls ceph_mdsmap_decode() with the front buffer bound. A malicious or compromised Ceph monitor, or an on-path attacker exploiting an unsigned and unencrypted messenger session, can craft an MDS map with a per-mds info version of 2 or 3 and an oversized num_export_targets field to trigger the out-of-bounds read remotely. No authentication or user interaction is required on the client side beyond an active CephFS mount.

See the kernel patch commit a3eb169e for the fix that adds a ceph_decode_need() call and uses size_mul() to compute the export-targets byte count safely.

Detection Methods for CVE-2026-89650

Indicators of Compromise

KASAN kernel logs reporting slab-out-of-bounds reads originating from ceph_mdsmap_decode() in fs/ceph/mdsmap.c.
Unexpected CephFS client crashes, warnings, or oops messages tied to processing of CEPH_MSG_MDS_MAP messages.
Unauthorized or unexpected Ceph monitor endpoints appearing in client mon_client session logs.

Detection Strategies

Monitor kernel ring buffer (dmesg, journalctl -k) for KASAN reports and BUG traces referencing ceph_mdsmap_decode or ceph_decode_32.
Correlate CephFS client kernel faults with inbound MDS map traffic from monitor sessions to identify malformed message activity.
Audit running kernel versions across fleets to identify hosts running unpatched CephFS-enabled kernels.

Monitoring Recommendations

Forward kernel logs from CephFS clients to a centralized logging pipeline for automated anomaly detection.
Track Ceph monitor endpoint IPs and alert on connections to unknown or unauthorized monitors.
Enforce messenger v2 with authentication and encryption (ms_mode=secure) to reduce exposure to on-path tampering with MDS map messages.

How to Mitigate CVE-2026-89650

Immediate Actions Required

Apply the upstream kernel patches referenced in the linked stable commits and reboot CephFS client hosts as soon as maintenance windows allow.
Restrict CephFS client connectivity to trusted, hardened monitor endpoints and block untrusted network paths to monitor ports (typically TCP 3300/6789).
Enable authenticated and encrypted messenger v2 (ms_mode=secure) on all CephFS mounts to prevent on-path attackers from injecting crafted MDS maps.

Patch Information

The fix adds a ceph_decode_need() call for the export-targets array before advancing the decode cursor, enforcing the bound for every info_v >= 2 rather than only info_v >= 4. The patch also computes the export-targets byte count using size_mul() so that overflow in the attacker-controlled multiplication fails closed rather than depending on later allocator guards. Stable kernel fixes are available in the following commits: 0c4bcc3, 332c444f, 3bf7dba8, 55a06b32, 58c2d3e9, a3eb169e, and eb3e1a1c.

Workarounds

Unmount CephFS on affected clients until patched kernels are deployed if operationally feasible.
Enforce messenger v2 secure mode on all Ceph client-monitor communication to block tampering by on-path attackers.
Segment CephFS client networks so only trusted monitor daemons are reachable, reducing exposure to compromised or rogue monitors.

bash

# Enforce authenticated and encrypted Ceph messenger v2 on client mounts
mount -t ceph <mon-host>:3300:/ /mnt/cephfs \
    -o name=<client>,secretfile=/etc/ceph/client.secret,ms_mode=secure

# Verify installed kernel version includes the fix
uname -r