GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89651 (GCVE-0-2026-89651)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-13 06:32
VLAI
Title
ceph: bound MDSCapAuth path and fs_name decode in handle_session()
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: bound MDSCapAuth path and fs_name decode in handle_session() handle_session() decodes the MDSCapAuth records carried by a CEPH_SESSION_OPEN message (msg_version >= 6). For each record the match.path and match.fs_name byte strings are read by first decoding a 32-bit length and then copying that many bytes with the bare ceph_decode_copy(). Unlike the surrounding fields, which all use the _safe decode variants, these two copies are not preceded by a ceph_decode_need() bounds check, and the enclosing MDSCapAuth and MDSCapMatch struct_len fields are skipped rather than enforced as an upper bound. A length larger than the bytes remaining in the message front makes ceph_decode_copy() read past the end of the front buffer. The message front is a dedicated allocation (ceph_msg_new2() -> kvmalloc), so the over-read runs off that object. A malicious or compromised MDS can trigger this with the first post-connect message on mount, with no client-side user interaction; under KASAN it is reported as a slab-out-of-bounds read in handle_session(). Impact: a malicious MDS can force the kernel client to read up to 4 GiB past the message front allocation during session setup, crashing the client (out-of-bounds read). Switch both copies to ceph_decode_copy_safe(), which performs the ceph_decode_need() bounds check before the copy and branches to the existing bad label, matching the rest of the decoder and the error path that frees the partially decoded cap_auths array.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1d17de9534cb5a4c4c380d174cc2f9281b34f89e , < dc5c7dffda92ef372fa587c444a1c537373df824 (git)
Affected: 1d17de9534cb5a4c4c380d174cc2f9281b34f89e , < c37db86d2b5e9b57001ccae7e7a727e95a4f9c02 (git)
Affected: 1d17de9534cb5a4c4c380d174cc2f9281b34f89e , < 5f892c767b30e4fb0c744c59f9235c717383d2cd (git)
Affected: 1d17de9534cb5a4c4c380d174cc2f9281b34f89e , < 77933e22adfe813be2bd10be08d6e950103c3967 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/mds_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dc5c7dffda92ef372fa587c444a1c537373df824",
              "status": "affected",
              "version": "1d17de9534cb5a4c4c380d174cc2f9281b34f89e",
              "versionType": "git"
            },
            {
              "lessThan": "c37db86d2b5e9b57001ccae7e7a727e95a4f9c02",
              "status": "affected",
              "version": "1d17de9534cb5a4c4c380d174cc2f9281b34f89e",
              "versionType": "git"
            },
            {
              "lessThan": "5f892c767b30e4fb0c744c59f9235c717383d2cd",
              "status": "affected",
              "version": "1d17de9534cb5a4c4c380d174cc2f9281b34f89e",
              "versionType": "git"
            },
            {
              "lessThan": "77933e22adfe813be2bd10be08d6e950103c3967",
              "status": "affected",
              "version": "1d17de9534cb5a4c4c380d174cc2f9281b34f89e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/mds_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: bound MDSCapAuth path and fs_name decode in handle_session()\n\nhandle_session() decodes the MDSCapAuth records carried by a\nCEPH_SESSION_OPEN message (msg_version \u003e= 6). For each record the\nmatch.path and match.fs_name byte strings are read by first decoding a\n32-bit length and then copying that many bytes with the bare\nceph_decode_copy(). Unlike the surrounding fields, which all use the\n_safe decode variants, these two copies are not preceded by a\nceph_decode_need() bounds check, and the enclosing MDSCapAuth and\nMDSCapMatch struct_len fields are skipped rather than enforced as an\nupper bound. A length larger than the bytes remaining in the message\nfront makes ceph_decode_copy() read past the end of the front buffer.\n\nThe message front is a dedicated allocation (ceph_msg_new2() -\u003e\nkvmalloc), so the over-read runs off that object. A malicious or\ncompromised MDS can trigger this with the first post-connect message on\nmount, with no client-side user interaction; under KASAN it is reported\nas a slab-out-of-bounds read in handle_session().\n\nImpact: a malicious MDS can force the kernel client to read up to 4 GiB\npast the message front allocation during session setup, crashing the\nclient (out-of-bounds read).\n\nSwitch both copies to ceph_decode_copy_safe(), which performs the\nceph_decode_need() bounds check before the copy and branches to the\nexisting bad label, matching the rest of the decoder and the error path\nthat frees the partially decoded cap_auths array."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - CEPH_MSG_CLIENT_SESSION arrives over the kernel Ceph messenger TCP session from an MDS peer; mds_dispatch() hands it to handle_session(), so a malicious or compromised MDS (or on-path attacker on an unsigned msgr session) reaches the unbounded decode with network data alone.\nAC:L - The attacker fully controls msg-\u003ehdr.version and the MDSCapAuth path/fs_name u32 lengths; setting version\u003e=6 and a length larger than remaining front bytes (or UINT_MAX) deterministically hits the unchecked ceph_decode_copy() with no race or layout dependency.\nPR:N - Exploitation requires only sending a crafted CEPH_SESSION_OPEN as the remote MDS peer on an established session; the attacker needs no account, capability, or mount privilege on the victim beyond the client already being connected to that cluster.\nUI:N - Once CephFS is mounted (standard in Rook/Kubernetes/OpenStack), the MDS emits CEPH_SESSION_OPEN as the first post-connect message on mount or reconnect, processed automatically in the ceph-msgr kworker with no further victim action at exploit time.\nS:U - The out-of-bounds read and any resulting kernel memory corruption stay inside the victim host\u0027s CephFS client kernel; they do not cross a VM, sandbox, or IOMMU security boundary.\nC:H - Unchecked ceph_decode_copy() of an attacker-chosen u32 length reads past the kvmalloc\u0027d message front into adjacent kernel memory and stores those bytes in match.path/match.fs_name; unbounded out-of-bounds reads are High per kernel guidance.\nI:H - Attacker-controlled _len is both the memcpy size and kcalloc(_len+1) count, so UINT_MAX wraps the allocation to ZERO_SIZE_PTR and the copy writes from address 16; over-read bytes are also installed as cap-auth path/fs_name used by ceph_mds_check_access, a memory-corruption primitive.\nA:H - The over-read runs off the dedicated message-front object and can fault on unmapped pages or vmalloc guard pages, oopsing the ceph-msgr worker as KASAN reported; a malicious MDS can repeat this on every session open."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:32:30.623Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dc5c7dffda92ef372fa587c444a1c537373df824"
        },
        {
          "url": "https://git.kernel.org/stable/c/c37db86d2b5e9b57001ccae7e7a727e95a4f9c02"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f892c767b30e4fb0c744c59f9235c717383d2cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/77933e22adfe813be2bd10be08d6e950103c3967"
        }
      ],
      "title": "ceph: bound MDSCapAuth path and fs_name decode in handle_session()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89651",
    "datePublished": "2026-09-11T19:45:41.620Z",
    "dateReserved": "2026-09-11T19:38:34.742Z",
    "dateUpdated": "2026-09-13T06:32:30.623Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89651",
      "date": "2026-09-16",
      "epss": "0.00626",
      "percentile": "0.48359"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89651\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:51.150\",\"lastModified\":\"2026-09-13T07:17:30.417\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: bound MDSCapAuth path and fs_name decode in handle_session()\\n\\nhandle_session() decodes the MDSCapAuth records carried by a\\nCEPH_SESSION_OPEN message (msg_version \u003e= 6). For each record the\\nmatch.path and match.fs_name byte strings are read by first decoding a\\n32-bit length and then copying that many bytes with the bare\\nceph_decode_copy(). Unlike the surrounding fields, which all use the\\n_safe decode variants, these two copies are not preceded by a\\nceph_decode_need() bounds check, and the enclosing MDSCapAuth and\\nMDSCapMatch struct_len fields are skipped rather than enforced as an\\nupper bound. A length larger than the bytes remaining in the message\\nfront makes ceph_decode_copy() read past the end of the front buffer.\\n\\nThe message front is a dedicated allocation (ceph_msg_new2() -\u003e\\nkvmalloc), so the over-read runs off that object. A malicious or\\ncompromised MDS can trigger this with the first post-connect message on\\nmount, with no client-side user interaction; under KASAN it is reported\\nas a slab-out-of-bounds read in handle_session().\\n\\nImpact: a malicious MDS can force the kernel client to read up to 4 GiB\\npast the message front allocation during session setup, crashing the\\nclient (out-of-bounds read).\\n\\nSwitch both copies to ceph_decode_copy_safe(), which performs the\\nceph_decode_need() bounds check before the copy and branches to the\\nexisting bad label, matching the rest of the decoder and the error path\\nthat frees the partially decoded cap_auths array.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ceph/mds_client.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1d17de9534cb5a4c4c380d174cc2f9281b34f89e\",\"lessThan\":\"dc5c7dffda92ef372fa587c444a1c537373df824\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d17de9534cb5a4c4c380d174cc2f9281b34f89e\",\"lessThan\":\"c37db86d2b5e9b57001ccae7e7a727e95a4f9c02\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d17de9534cb5a4c4c380d174cc2f9281b34f89e\",\"lessThan\":\"5f892c767b30e4fb0c744c59f9235c717383d2cd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1d17de9534cb5a4c4c380d174cc2f9281b34f89e\",\"lessThan\":\"77933e22adfe813be2bd10be08d6e950103c3967\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ceph/mds_client.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5f892c767b30e4fb0c744c59f9235c717383d2cd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/77933e22adfe813be2bd10be08d6e950103c3967\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c37db86d2b5e9b57001ccae7e7a727e95a4f9c02\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dc5c7dffda92ef372fa587c444a1c537373df824\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-13T06:51:09+00:00",
      "cve": "CVE-2026-89651",
      "id": "CVE-2026-89651",
      "initial_release_date": "2026-09-11T19:45:41.620000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ceph: Linux kernel Ceph client: Out-of-bounds read leads to denial of service",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89651.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T00:01:08Z",
      "cve": "CVE-2026-89651",
      "id": "CVE-2026-89651",
      "initial_release_date": "2026-09-12T16:24:15Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "324",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89651",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89651.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.