CVE-2026-89657: Linux Kernel libceph DOS Vulnerability

CVE-2026-89657 Overview

CVE-2026-89657 is a high-severity denial-of-service vulnerability in the Linux kernel's libceph subsystem. The flaw resides in net/ceph/osd_client.c where the osd_sparse_read() function validates total sparse-read data length but fails to verify that individual Object Storage Daemon (OSD) extents are monotonic and within the original request range. A malicious authenticated OSD peer can send a malformed sparse-read reply that advances the message-data cursor past the request buffer, triggering a BUG_ON(!*length) assertion in ceph_msg_data_next().

Critical Impact
A malicious or compromised authenticated Ceph OSD peer can crash a kernel Ceph client through a malformed sparse-read reply, resulting in a kernel panic and loss of availability.

Affected Products

Linux kernel libceph module (net/ceph/osd_client.c)
Kernel Ceph client consumers (CephFS, RBD)
Kernel versions prior to the fixes referenced in commits 058ffa8, 201db40, 2571b35, 94ae514, and 9ec08b7

Discovery Timeline

2026-09-11 - CVE-2026-89657 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89657

Vulnerability Analysis

The vulnerability exists in the sparse-read handling path of the kernel Ceph client. When an OSD returns data for a sparse-read request, it supplies an extent map that describes which offsets within the request contain valid data. The osd_sparse_read() function checks that the sum of extent lengths equals the reported data length but performs no bounds or ordering validation on individual extents.

An authenticated OSD peer can supply an extent with a far-forward nonzero offset accompanied by a matching data length. When the client processes this reply, the message-data cursor advances beyond the caller's request buffer. The kernel then reaches the BUG_ON(!*length) assertion inside ceph_msg_data_next() on the receive path, causing an immediate kernel panic.

Root Cause

The root cause is missing input validation on OSD-supplied extent metadata. osd_sparse_read() accepts extents that overflow arithmetic bounds, move backwards, overlap with prior extents, or extend outside the original sparse-read request. Because the aggregate length check succeeds even when individual extents point outside the buffer, the cursor arithmetic operates on attacker-controlled offsets.

Attack Vector

Exploitation requires an attacker to control or compromise an authenticated Ceph OSD that a targeted kernel client communicates with. The attacker crafts a sparse-read reply containing malformed extent maps and returns it in response to a legitimate client read. No user interaction is needed on the client side. Because the flaw triggers a BUG_ON in the network receive path, successful exploitation results in a kernel panic on the client host.

The upstream fix rejects sparse extent maps that overflow, move backwards, overlap, or extend outside the original request range before advancing the cursor. Maintainer idryomov moved the sparse_extent_map_valid() check into the CEPH_SPARSE_READ_DATA_LEN state so validation occurs before any cursor manipulation. See the Kernel Stable Commit 058ffa8 for the reference implementation.

Detection Methods for CVE-2026-89657

Indicators of Compromise

Unexpected kernel panics on hosts mounting CephFS or mapping RBD images, with stack traces referencing ceph_msg_data_next, osd_sparse_read, or libceph.
Kernel ring buffer messages containing BUG_ON assertions originating from net/ceph/ code paths.
Repeated client crashes correlated with reads served by a specific OSD in the Ceph cluster.

Detection Strategies

Collect kernel crash dumps via kdump and inspect stack traces for libceph frames using crash or drgn.
Correlate client-side panic timestamps with OSD access logs to identify anomalous peers returning malformed replies.
Monitor Ceph cluster telemetry for OSDs exhibiting protocol anomalies or unexpected sparse-read response patterns.

Monitoring Recommendations

Aggregate dmesg and journal output centrally to identify recurring libceph-related faults across hosts.
Track OSD daemon integrity by comparing running binaries and configurations against known-good baselines.
Alert on Ceph client mount instability, sudden node reboots, or workload interruptions on Ceph-dependent systems.

How to Mitigate CVE-2026-89657

Immediate Actions Required

Inventory all Linux hosts running kernel Ceph clients, including CephFS mounts and RBD-mapped block devices.
Update to a Linux kernel that includes one of the referenced stable commits (058ffa8, 201db40, 2571b35, 94ae514, or 9ec08b7).
Audit Ceph cluster membership and remove or isolate any OSDs whose provenance or integrity cannot be verified.
Enforce mutual authentication using cephx and restrict network reachability to trusted OSD peers only.

Patch Information

The fix rejects malformed sparse extent maps in osd_sparse_read() before advancing the message-data cursor. Distribution kernels should incorporate the upstream stable commits: 058ffa8, 201db40, 2571b35, 94ae514, and 9ec08b7. Apply vendor-provided kernel updates from your Linux distribution as they become available.

Workarounds

No configuration workaround eliminates the flaw; the vulnerability lives in kernel receive-path code that runs for all sparse reads.
Restrict Ceph client network exposure using firewall rules to limit connectivity to trusted OSDs only.
Enable strict cephx authentication and rotate keys for any OSD that may have been compromised.
Consider disabling sparse-read functionality where operationally feasible until patches are applied.

bash

# Verify running kernel version and reboot into a patched kernel after update
uname -r
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-generic
sudo systemctl reboot