CVE-2026-89649

A flaw was found in the Linux kernel's Ceph file system (CephFS) component. A malicious or compromised metadata server can manipulate the length of an extended attribute (xattr) value, causing the system to read beyond the intended memory boundary. This out-of-bounds read allows a local user to access sensitive data from the kernel's memory, leading to information disclosure.

A kernel heap out-of-bounds read in CephFS xattr decoding can occur because __build_xattrs() validates the encoded value length field but did not verify that the final value bytes remain inside the MDS supplied xattr blob. A malicious or compromised Ceph metadata server can set the last xattr value length larger than the bytes actually present, causing a later getxattr(2) call to copy adjacent kernel heap bytes to a user buffer. For the CVSS the PR:L is used because the disclosure is obtained through a local user context calling getxattr(2) on the affected CephFS mount, while the malformed metadata is supplied by the MDS. The issue is not a direct public Internet attack against an arbitrary host, but it is relevant in environments where CephFS clients trust storage servers or metadata servers reachable over an internal storage network. Impact is confidentiality loss through kernel memory disclosure, with no concrete write primitive or privilege escalation primitive shown by this patch.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.