GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89652 (GCVE-0-2026-89652)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-14 12:01
VLAI
Title
ceph: bound copied dentry name length in NFS export get_name
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export get_name ceph_get_name() copies the MDS-supplied name into the caller's NAME_MAX-sized buffer with memcpy(name, rinfo->dname, rinfo->dname_len) and then writes name[rinfo->dname_len] = 0, without checking dname_len against NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME reply with dname_len > NAME_MAX overflows the buffer. __get_snap_name() copies rde->name / rde->name_len the same unchecked way. Impact: a malicious or compromised Ceph MDS overflows the NAME_MAX name buffer in a client's NFS-export get_name path, a slab out-of-bounds write reported by KASAN. Reachable when a CephFS mount is re-exported over NFS. Add ceph_export_copy_name(), which rejects lengths above NAME_MAX with -ENAMETOOLONG before the copy, and use it in both ceph_get_name() and __get_snap_name().
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 19913b4eac4a230dccb548931358398f45dabe4c , < a294064e0e0f81ea607b2f019e16888aa1b0a011 (git)
Affected: 19913b4eac4a230dccb548931358398f45dabe4c , < 61d9f27b191b838b96b697ce0bfaee39a138243a (git)
Affected: 19913b4eac4a230dccb548931358398f45dabe4c , < 06fb5e623cdc2402d6bb29be94d9beb9a826ffec (git)
Affected: 19913b4eac4a230dccb548931358398f45dabe4c , < e7c2fd3893a7f7fcd7e8cf0b2c6348bb1e893df6 (git)
Affected: 19913b4eac4a230dccb548931358398f45dabe4c , < eff8013c5a8916613c742ae5a2cc341cb605c0ae (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.15
Unaffected: 0 , < 3.15 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/export.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a294064e0e0f81ea607b2f019e16888aa1b0a011",
              "status": "affected",
              "version": "19913b4eac4a230dccb548931358398f45dabe4c",
              "versionType": "git"
            },
            {
              "lessThan": "61d9f27b191b838b96b697ce0bfaee39a138243a",
              "status": "affected",
              "version": "19913b4eac4a230dccb548931358398f45dabe4c",
              "versionType": "git"
            },
            {
              "lessThan": "06fb5e623cdc2402d6bb29be94d9beb9a826ffec",
              "status": "affected",
              "version": "19913b4eac4a230dccb548931358398f45dabe4c",
              "versionType": "git"
            },
            {
              "lessThan": "e7c2fd3893a7f7fcd7e8cf0b2c6348bb1e893df6",
              "status": "affected",
              "version": "19913b4eac4a230dccb548931358398f45dabe4c",
              "versionType": "git"
            },
            {
              "lessThan": "eff8013c5a8916613c742ae5a2cc341cb605c0ae",
              "status": "affected",
              "version": "19913b4eac4a230dccb548931358398f45dabe4c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/export.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: bound copied dentry name length in NFS export get_name\n\nceph_get_name() copies the MDS-supplied name into the caller\u0027s\nNAME_MAX-sized buffer with memcpy(name, rinfo-\u003edname, rinfo-\u003edname_len)\nand then writes name[rinfo-\u003edname_len] = 0, without checking dname_len\nagainst NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME reply\nwith dname_len \u003e NAME_MAX overflows the buffer. __get_snap_name() copies\nrde-\u003ename / rde-\u003ename_len the same unchecked way.\n\nImpact: a malicious or compromised Ceph MDS overflows the NAME_MAX name\nbuffer in a client\u0027s NFS-export get_name path, a slab out-of-bounds write\nreported by KASAN. Reachable when a CephFS mount is re-exported over NFS.\n\nAdd ceph_export_copy_name(), which rejects lengths above NAME_MAX with\n-ENAMETOOLONG before the copy, and use it in both ceph_get_name() and\n__get_snap_name()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ceph_get_name() copies LOOKUPNAME/LSSNAP dentry names from a Ceph MDS reply over TCP, and nfsd reaches that callback via exportfs_decode_fh_raw() when CephFS is re-exported, so a remote MDS (or NFS client against such a gateway) hits the overflow on the network path.\nAC:L - A malicious MDS fully controls dname_len and the name bytes. nfsd lookup of a Ceph directory uses d_obtain_alias() then reconnect_path(), which deterministically calls get_name; no race, rare config, or uncontrollable layout is required.\nPR:N - No local account or capability on the victim is needed. A compromised or malicious MDS supplies the overflowing name, and on NFS-reexported CephFS any remote NFS client can force LOOKUPNAME by presenting a directory filehandle.\nUI:N - Once CephFS is mounted and re-exported over NFS, nfsd directory filehandle resolution automatically issues LOOKUPNAME and copies the MDS reply; no extra victim mount, click, or interactive step is required at exploit time.\nS:U - The overflow corrupts kernel stack/memory on the NFS/Ceph client host and does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - Unbounded memcpy of MDS-controlled name bytes past the NAME_MAX+1 exportfs buffer is memory corruption that can overwrite adjacent kernel objects and be leveraged for arbitrary disclosure.\nI:H - Attacker-controlled length and contents overflow the NAME_MAX+1 stack buffer in exportfs_decode_fh_raw(), enabling an arbitrary write and control-flow hijacking.\nA:H - The same out-of-bounds write of a 256-byte name buffer by an MDS-chosen length, reported as a KASAN OOB write, reliably oopses or panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:01:47.069Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a294064e0e0f81ea607b2f019e16888aa1b0a011"
        },
        {
          "url": "https://git.kernel.org/stable/c/61d9f27b191b838b96b697ce0bfaee39a138243a"
        },
        {
          "url": "https://git.kernel.org/stable/c/06fb5e623cdc2402d6bb29be94d9beb9a826ffec"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7c2fd3893a7f7fcd7e8cf0b2c6348bb1e893df6"
        },
        {
          "url": "https://git.kernel.org/stable/c/eff8013c5a8916613c742ae5a2cc341cb605c0ae"
        }
      ],
      "title": "ceph: bound copied dentry name length in NFS export get_name",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89652",
    "datePublished": "2026-09-11T19:45:42.443Z",
    "dateReserved": "2026-09-11T19:38:34.742Z",
    "dateUpdated": "2026-09-14T12:01:47.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89652",
      "date": "2026-09-15",
      "epss": "0.00463",
      "percentile": "0.38946"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89652\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:51.283\",\"lastModified\":\"2026-09-14T13:19:17.560\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: bound copied dentry name length in NFS export get_name\\n\\nceph_get_name() copies the MDS-supplied name into the caller\u0027s\\nNAME_MAX-sized buffer with memcpy(name, rinfo-\u003edname, rinfo-\u003edname_len)\\nand then writes name[rinfo-\u003edname_len] = 0, without checking dname_len\\nagainst NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME reply\\nwith dname_len \u003e NAME_MAX overflows the buffer. __get_snap_name() copies\\nrde-\u003ename / rde-\u003ename_len the same unchecked way.\\n\\nImpact: a malicious or compromised Ceph MDS overflows the NAME_MAX name\\nbuffer in a client\u0027s NFS-export get_name path, a slab out-of-bounds write\\nreported by KASAN. Reachable when a CephFS mount is re-exported over NFS.\\n\\nAdd ceph_export_copy_name(), which rejects lengths above NAME_MAX with\\n-ENAMETOOLONG before the copy, and use it in both ceph_get_name() and\\n__get_snap_name().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ceph/export.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"19913b4eac4a230dccb548931358398f45dabe4c\",\"lessThan\":\"a294064e0e0f81ea607b2f019e16888aa1b0a011\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"19913b4eac4a230dccb548931358398f45dabe4c\",\"lessThan\":\"61d9f27b191b838b96b697ce0bfaee39a138243a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"19913b4eac4a230dccb548931358398f45dabe4c\",\"lessThan\":\"06fb5e623cdc2402d6bb29be94d9beb9a826ffec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"19913b4eac4a230dccb548931358398f45dabe4c\",\"lessThan\":\"e7c2fd3893a7f7fcd7e8cf0b2c6348bb1e893df6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"19913b4eac4a230dccb548931358398f45dabe4c\",\"lessThan\":\"eff8013c5a8916613c742ae5a2cc341cb605c0ae\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ceph/export.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/06fb5e623cdc2402d6bb29be94d9beb9a826ffec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/61d9f27b191b838b96b697ce0bfaee39a138243a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a294064e0e0f81ea607b2f019e16888aa1b0a011\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e7c2fd3893a7f7fcd7e8cf0b2c6348bb1e893df6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eff8013c5a8916613c742ae5a2cc341cb605c0ae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-13T06:51:12+00:00",
      "cve": "CVE-2026-89652",
      "id": "CVE-2026-89652",
      "initial_release_date": "2026-09-11T19:45:42.443000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ceph: Linux kernel (Ceph): Buffer overflow leads to memory corruption in NFS export",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89652.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T00:01:07Z",
      "cve": "CVE-2026-89652",
      "id": "CVE-2026-89652",
      "initial_release_date": "2026-09-12T16:24:13Z",
      "product_status:known_affected": "349",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89652",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89652.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.