CVE-2026-89652: Linux Kernel CephFS Buffer Overflow Vulnerability

CVE-2026-89652 Overview

CVE-2026-89652 is an out-of-bounds write vulnerability in the Linux kernel's Ceph filesystem client. The flaw resides in the ceph_get_name() function used when a CephFS mount is re-exported over Network File System (NFS). The function copies a Metadata Server (MDS) supplied dentry name into a NAME_MAX-sized buffer without validating dname_len against NAME_MAX. A malicious or compromised MDS returning a LOOKUPNAME reply with an oversized dname_len triggers a slab out-of-bounds write, confirmed by the Kernel Address Sanitizer (KASAN). The same unchecked copy pattern exists in __get_snap_name(), which processes rde->name and rde->name_len.

Critical Impact
A malicious Ceph MDS can trigger a slab out-of-bounds write in Linux kernel clients that re-export CephFS over NFS, enabling potential memory corruption and remote code execution.

Affected Products

Linux kernel with CephFS client (fs/ceph) compiled in
Systems re-exporting CephFS mounts over NFS
Kernel builds prior to the fixes referenced in the stable tree commits

Discovery Timeline

2026-09-11 - CVE-2026-89652 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89652

Vulnerability Analysis

The vulnerability exists in the CephFS client code path invoked when the kernel translates a filesystem handle to a name for NFS export operations. ceph_get_name() receives a caller-supplied buffer sized to NAME_MAX bytes. It then executes memcpy(name, rinfo->dname, rinfo->dname_len) followed by name[rinfo->dname_len] = 0. Neither operation validates that rinfo->dname_len fits within the destination buffer. When the length exceeds NAME_MAX, the copy writes past the allocated slab object boundary.

The __get_snap_name() function follows the same unchecked pattern when handling snapshot directory entries through rde->name and rde->name_len. Both code paths trust length values delivered by the Metadata Server without bounds enforcement.

This flaw is classified as an Out-of-Bounds Write [CWE-787] and a Buffer Overflow condition. KASAN reports confirm the slab corruption, which can be leveraged for memory disclosure, denial of service, or arbitrary code execution in kernel context.

Root Cause

The root cause is missing input validation on network-supplied length fields. Kernel code assumed the MDS would never return dentry names exceeding NAME_MAX. A protocol-level bounds check was absent before the fixed-size buffer copy.

Attack Vector

Exploitation requires a Ceph client to mount a filesystem served by an attacker-controlled or compromised MDS, and to re-export that mount over NFS. The attacker returns a crafted LOOKUPNAME reply with dname_len > NAME_MAX. When the NFS server invokes get_name on an exported file handle, the client executes the vulnerable memcpy, overwriting adjacent slab memory.

The vulnerability manifests in ceph_get_name() and __get_snap_name() in fs/ceph/export.c. See the referenced Kernel Commit eff8013 for the corrective patch that introduces ceph_export_copy_name() and rejects oversized lengths with -ENAMETOOLONG before the copy.

Detection Methods for CVE-2026-89652

Indicators of Compromise

KASAN reports in dmesg referencing slab-out-of-bounds writes originating from ceph_get_name or __get_snap_name
Unexpected kernel panics or oops messages on NFS servers re-exporting CephFS mounts
CephFS clients connecting to MDS instances outside the trusted management domain

Detection Strategies

Audit kernel versions on all hosts running the ceph module and cross-reference against the fixed commits
Enumerate NFS export configurations to identify systems re-exporting CephFS paths
Enable KASAN on test kernels to surface out-of-bounds writes during CephFS-over-NFS workload validation

Monitoring Recommendations

Collect kernel logs centrally and alert on BUG: KASAN entries referencing fs/ceph
Monitor MDS session establishment and flag connections from unauthorized MDS endpoints
Track NFS server crash rates and correlate with CephFS re-export activity

How to Mitigate CVE-2026-89652

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the CVE record on all systems running the CephFS client
Restrict CephFS mounts to MDS instances under trusted administrative control
Disable NFS re-export of CephFS mounts on hosts that cannot be patched immediately

Patch Information

The fix introduces a new helper, ceph_export_copy_name(), which validates the source length against NAME_MAX and returns -ENAMETOOLONG before performing the copy. The helper replaces the unchecked memcpy in both ceph_get_name() and __get_snap_name(). Backports are available for supported stable branches through the following commits: Kernel Commit 06fb5e6, Kernel Commit 61d9f27, Kernel Commit a294064, Kernel Commit e7c2fd3, and Kernel Commit eff8013.

Workarounds

Remove CephFS paths from /etc/exports and reload the NFS server configuration until patched kernels are deployed
Isolate Ceph cluster traffic on management-only networks with strict authentication using CephX
Deploy patched kernels via distribution vendor advisories and reboot affected NFS gateway hosts

bash

# Remove CephFS re-export entries and reload NFS exports
sudo sed -i '/\/mnt\/cephfs/d' /etc/exports
sudo exportfs -ra
sudo systemctl restart nfs-server