CVE-2026-89656: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89656 Overview

CVE-2026-89656 is an out-of-bounds write vulnerability in the Linux kernel's libceph module. The flaw resides in the CRUSH (Controlled Replication Under Scalable Hashing) map decoder used by Ceph clients. A malformed CRUSH map can cause bucket_perm_choose() to write beyond an allocated permutation array, corrupting adjacent kernel memory in the kvmalloc'd CRUSH workspace. Kernel Address Sanitizer (KASAN) reports a slab out-of-bounds write of 4 bytes when the condition triggers. The upstream fix rejects buckets whose encoded id does not match their array slot, restoring the invariant expected by work->work[-1 - in->id].

Critical Impact
A malformed CRUSH map delivered from a compromised or malicious Ceph monitor can corrupt kernel memory on any client mounting a Ceph filesystem or RBD image, enabling denial of service and potential privilege escalation.

Affected Products

Linux kernel libceph module (multiple stable branches)
Systems using kernel Ceph client (ceph.ko, rbd.ko)
Distributions shipping the affected kernel versions prior to the referenced stable commits

Discovery Timeline

2026-09-11 - CVE-2026-89656 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89656

Vulnerability Analysis

The vulnerability affects crush_decode() in the Linux kernel libceph subsystem. CRUSH is the pseudo-random data placement algorithm Ceph uses to determine object locations across storage devices. During decoding, bucket data is stored by array slot, and the CRUSH mapper later derives the per-bucket workspace index from the decoded bucket id using the expression work->work[-1 - in->id].

When a bucket encodes an id different from the canonical -1 - slot, the mapper computes an index that points to another bucket's workspace region. For uniform buckets, the second replica selection expands the source bucket's permutation into this aliased workspace buffer. If the source bucket is larger than the aliased bucket, the permutation write extends past the smaller array and escapes the CRUSH workspace allocation.

Root Cause

The root cause is a missing invariant check between the decoded bucket id and its array slot in crush_decode(). The mapper assumes that every bucket's id equals -1 - slot, but the decoder never enforces that relationship. Consequently, a crafted map can alias one bucket's workspace to another and produce an out-of-bounds slab write in bucket_perm_choose().

Attack Vector

The attack vector is network-based. A Ceph client receives CRUSH map updates from monitors as part of normal cluster operation. An attacker able to inject a crafted CRUSH map, through a compromised monitor, a hostile cluster, or a man-in-the-middle position on an unauthenticated channel, can trigger the out-of-bounds write on any kernel client processing the map. Exploitation requires no user interaction and no local privileges on the victim system.

The vulnerability is described in the upstream fix commits. See the Kernel Git Commit 3cde4a8 and related backports for the corrective change.

Detection Methods for CVE-2026-89656

Indicators of Compromise

KASAN kernel log entries reporting slab-out-of-bounds writes of 4 bytes in bucket_perm_choose
Unexpected kernel panics or oops messages referencing libceph, crush_decode, or crush_do_rule
Ceph client hosts receiving CRUSH map updates from monitors outside the expected cluster membership

Detection Strategies

Monitor dmesg and journalctl -k for stack traces originating in libceph or crush_* symbols
Correlate Ceph monitor authentication events with unexpected client reconnections or map epoch changes
Audit kernel versions across fleet inventory to identify hosts still running vulnerable libceph builds

Monitoring Recommendations

Ingest kernel telemetry and Ceph client logs into a centralized SIEM for correlation of crash events across the fleet
Alert on newly observed Ceph monitor endpoints or unauthenticated cephx sessions
Track patch compliance for kernel updates on all hosts mounting CephFS or mapping RBD images

How to Mitigate CVE-2026-89656

Immediate Actions Required

Apply the vendor-provided kernel update containing the libceph CRUSH decoder fix to all Ceph clients
Restrict network access to Ceph monitors so that only trusted cluster members can deliver CRUSH map updates
Enable and enforce cephx authentication and require signed messages between clients and monitors

Patch Information

The fix rejects buckets whose encoded id does not match their array slot. Backports are available across multiple stable branches. See the following upstream commits for the corrective changes:

Workarounds

Unmount CephFS and unmap RBD devices on hosts that cannot be patched immediately
Isolate Ceph client networks behind firewall rules that only permit traffic to trusted monitor IP addresses
Prefer userspace Ceph clients (librbd, ceph-fuse) over the kernel client on unpatched systems, since the vulnerable code path is in the kernel module

bash

# Verify running kernel and libceph module version
uname -r
modinfo libceph | grep -E '^(version|srcversion|filename)'

# Temporarily disable kernel Ceph clients on unpatched hosts
sudo umount -a -t ceph
sudo rbd unmap --all
sudo modprobe -r rbd ceph libceph