CVE-2026-89648

A flaw was found in the Linux kernel's Ceph client. A malicious or compromised Ceph Metadata Server (MDS) could send a specially crafted reply with an unbounded number of delegated inode intervals. This could cause the client to enter an infinite loop or exhaust memory resources, leading to a denial of service (DoS) for the client system.

A Ceph client can consume unbounded CPU time or memory while parsing delegated inode intervals from an MDS create with delegation reply. The vulnerable path trusts the 64 bit len value after only checking that the bytes are present, then loops over len and inserts entries into the per session delegated inode xarray. A malicious or compromised MDS can send a huge interval, many intervals, duplicate ranges, or repeated replies to make the client spin or grow the xarray without a bound. For the CVSS the PR:N is used because no privileges are required on the victim client once the attacker can control or impersonate the MDS endpoint. The issue is network reachable through Ceph MDS protocol traffic, although Ceph MDS services are usually deployed on trusted storage or data center networks rather than the public Internet. Impact is denial of service through CPU exhaustion or memory exhaustion. No confidentiality or integrity impact is assigned because the patch supports a resource exhaustion class rather than a memory corruption primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.