CVE-2026-89653: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89653 Overview

CVE-2026-89653 is a kernel vulnerability in the Linux Ceph client. The flaw resides in the mdsmap decoding path, where export_targets entries supplied by the monitor are used as bit indices into a fixed-size stack bitmap by check_new_map(). A rank value outside the protocol namespace causes set_bit() to write past the end of the array, producing an out-of-bounds write on the kernel stack. The fix rejects ranks greater than or equal to CEPH_MAX_MDS while decoding the map. Because export_targets is monitor-controlled, a compromised or malicious Ceph monitor can trigger the condition on any client mounting the file system.

Critical Impact
A malicious or compromised Ceph monitor can trigger a kernel stack out-of-bounds write on any connected client, enabling denial of service and potential kernel memory corruption.

Affected Products

Linux kernel Ceph client (fs/ceph)
Stable kernel branches receiving backports referenced in the linked commits
Systems mounting CephFS via the in-kernel client

Discovery Timeline

2026-09-11 - CVE-2026-89653 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89653

Vulnerability Analysis

The Linux kernel Ceph client decodes MDSMap structures received from Ceph monitors. Each map entry may contain an export_targets list identifying peer MDS ranks. During processing in check_new_map(), the client iterates each target rank and passes it to set_bit() against a stack-allocated bitmap sized to hold CEPH_MAX_MDS bits.

The decoder did not validate that each rank fell within the protocol range. A monitor could send a rank value greater than or equal to CEPH_MAX_MDS, causing set_bit() to compute an offset past the bitmap array. The result is a write to kernel stack memory outside the intended object, which can corrupt adjacent frame data such as saved registers or return addresses.

The patch adds range enforcement inside the map decoder, rejecting any rank outside CEPH_MAX_MDS before the value ever reaches set_bit(). The commit intentionally does not validate against possible_max_rank, because valid maps may reference ranks beyond a temporarily reduced max_mds.

Root Cause

The root cause is missing input validation on attacker-influenced data used as an array index [CWE-129, CWE-787]. The kernel trusted monitor-supplied rank values and passed them directly to bitmap primitives without bounds enforcement.

Attack Vector

An attacker positioned to send crafted MDSMap messages, such as a compromised Ceph monitor or a network attacker able to inject monitor traffic, delivers an export_targets entry with a rank outside CEPH_MAX_MDS. The client processes the map during normal cluster operation, and the out-of-bounds write occurs in kernel context without any user interaction on the affected host.

No verified public exploit code is available. See the upstream commits including Kernel Git Commit 3740c88 and Kernel Git Commit c4addcc for the exact code change.

Detection Methods for CVE-2026-89653

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ceph_mdsmap_decode or check_new_map on hosts mounting CephFS.
Stack corruption warnings from KASAN or stack protector on Ceph client nodes.
Ceph client disconnect and remount cycles correlated with monitor map updates.

Detection Strategies

Inventory Linux hosts running the in-kernel Ceph client and cross-reference kernel build hashes against the fixed commits listed in the upstream references.
Monitor dmesg and journald for ceph: warnings emitted by the new rank-rejection logic after patching, which indicate malformed maps in flight.
Baseline Ceph monitor traffic sources and alert on unexpected peers publishing MDSMap updates.

Monitoring Recommendations

Forward kernel logs from CephFS clients to a central log platform and alert on Ceph subsystem faults.
Track Ceph monitor identity and network path integrity to detect tampering or spoofed monitor sessions.
Correlate client-side kernel warnings with monitor election events to identify anomalous MDSMap publications.

How to Mitigate CVE-2026-89653

Immediate Actions Required

Update affected Linux kernels to a version containing the fix from the referenced stable commits.
Restrict network reachability between Ceph clients and monitors to trusted management networks only.
Audit and rotate credentials for any Ceph monitor suspected of compromise.

Patch Information

The fix rejects export_targets ranks greater than or equal to CEPH_MAX_MDS during mdsmap decoding. The change is distributed across the following upstream commits: Kernel Git Commit 3740c88, Kernel Git Commit 4d29888, Kernel Git Commit 736adee, Kernel Git Commit 8c823bb, Kernel Git Commit 96c3f5f, Kernel Git Commit aedc905, and Kernel Git Commit c4addcc.

Workarounds

Unmount CephFS on hosts that cannot be patched immediately and use userspace clients such as ceph-fuse where feasible.
Segment Ceph monitor traffic on isolated VLANs and enforce firewall rules limiting which hosts can source monitor messages.
Enable cephx authentication cluster-wide and verify monitor keyring integrity to reduce the risk of unauthorized map publication.

bash

# Verify running kernel and confirm patch presence
uname -r
grep -E 'ceph|CEPH_MAX_MDS' /boot/config-$(uname -r)

# Restrict Ceph monitor traffic to trusted subnet (example: 10.10.0.0/24)
iptables -A INPUT -p tcp --dport 3300 ! -s 10.10.0.0/24 -j DROP
iptables -A INPUT -p tcp --dport 6789 ! -s 10.10.0.0/24 -j DROP