CVE-2026-89651: Linux Kernel Ceph Buffer Overflow Vulnerability

CVE-2026-89651 Overview

CVE-2026-89651 is an out-of-bounds read vulnerability in the Linux kernel Ceph client. The flaw resides in the handle_session() function, which processes CEPH_SESSION_OPEN messages with msg_version >= 6. When decoding MDSCapAuth records, the match.path and match.fs_name byte strings are copied using the unsafe ceph_decode_copy() primitive without a preceding ceph_decode_need() bounds check. A malicious or compromised Metadata Server (MDS) can supply an oversized length field, causing the kernel to read up to 4 GiB past the message front allocation. Exploitation requires no client-side user interaction and is triggered on mount.

Critical Impact
A malicious MDS can crash Linux kernel clients on mount by forcing an out-of-bounds read during Ceph session setup.

Affected Products

Linux kernel Ceph client (fs/ceph)
Systems mounting CephFS via the in-kernel client
Distributions shipping affected upstream kernel versions prior to the referenced stable commits

Discovery Timeline

2026-09-11 - CVE-2026-89651 published to the National Vulnerability Database
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89651

Vulnerability Analysis

The vulnerability exists in the Ceph kernel client's session handling logic. When a Ceph client mounts a filesystem, the Metadata Server responds with a CEPH_SESSION_OPEN message. For protocol version 6 and above, this message carries an array of MDSCapAuth records describing capability authorization rules. Each record contains variable-length match.path and match.fs_name fields, each prefixed by a 32-bit length.

The decoder reads the length field and then invokes ceph_decode_copy() to copy that many bytes from the message front buffer. Unlike other fields in the same code path, these two copies bypass the _safe decode variants that validate available buffer space. The enclosing MDSCapAuth and MDSCapMatchstruct_len fields are skipped rather than enforced as an upper bound, so the decoder trusts attacker-controlled lengths.

Root Cause

The root cause is missing bounds validation before a memory copy operation. The message front is a dedicated allocation created through ceph_msg_new2() and kvmalloc. When the attacker-supplied length exceeds the remaining bytes in that allocation, ceph_decode_copy() reads beyond the object boundary. KASAN reports the condition as a slab-out-of-bounds read in handle_session().

Attack Vector

A malicious or compromised MDS can trigger the flaw with the first post-connect message during mount. No authenticated user session, credentials, or interaction is required on the client side. Because the length prefix is a 32-bit unsigned value, an attacker can force an over-read of up to 4 GiB past the front allocation, reliably crashing the client kernel.

The fix converts both copies to ceph_decode_copy_safe(), which performs the ceph_decode_need() bounds check before copying and branches to the existing bad error label. That path frees the partially decoded cap_auths array and returns an error, matching the pattern used by the surrounding decoder.

Detection Methods for CVE-2026-89651

Indicators of Compromise

KASAN reports containing slab-out-of-bounds in handle_session from the ceph module
Kernel oops or panic during CephFS mount operations, particularly immediately after MDS connection
Unexpected client disconnects or reboots correlated with connections to untrusted or newly introduced Ceph MDS endpoints

Detection Strategies

Monitor kernel logs (dmesg, journalctl -k) for crash signatures referencing handle_session, ceph_decode_copy, or MDSCapAuth decoding
Inventory hosts running affected kernel versions against the fixed commits 5f892c76, 77933e22, c37db86d, and dc5c7dff
Alert on repeated CephFS mount failures or client reconnection loops that may indicate exploitation attempts

Monitoring Recommendations

Enable centralized kernel log collection for all hosts mounting CephFS
Correlate MDS connection events with client-side crash telemetry to identify malicious or misbehaving metadata servers
Track kernel version compliance across the fleet and flag hosts pending patch deployment

How to Mitigate CVE-2026-89651

Immediate Actions Required

Apply the upstream kernel fix or vendor backport that replaces ceph_decode_copy() with ceph_decode_copy_safe() in handle_session()
Restrict CephFS clients to mount only trusted MDS endpoints under administrative control
Enforce network-level access controls between Ceph clients and MDS nodes to prevent connections to rogue metadata servers

Patch Information

The fix is available in the upstream Linux kernel through the following stable commits: 5f892c76, 77933e22, c37db86d, and dc5c7dff. Rebuild or update the kernel package to a version containing these commits and reboot affected hosts.

Workarounds

Where patching is delayed, unmount CephFS filesystems and disable automatic mounts until kernels are updated
Segment Ceph cluster traffic on isolated management networks to reduce exposure to untrusted MDS nodes
Use userspace Ceph clients (for example ceph-fuse) as a temporary alternative on hosts that cannot be immediately patched

bash

# Verify kernel version and check for fixed commits
uname -r
zcat /proc/config.gz | grep CONFIG_CEPH_FS

# Unmount CephFS as a temporary mitigation
umount -a -t ceph