CVE-2026-89650

A flaw was found in the Linux kernel's Ceph client. A malicious or compromised Ceph monitor, or an on-path attacker, can send a specially crafted Metadata Server (MDS) map. This map, with an oversized num_export_targets field and a per-MDS info version of 2 or 3, can trigger an out-of-bounds read in the client kernel. This could lead to system instability or a denial of service.

A kernel out-of-bounds read in the CephFS MDS map decoder can occur because ceph_mdsmap_decode can advance the decode cursor using attacker-controlled num_export_targets for info_v 2 or 3 without first checking that the export target array is inside the message buffer. A malicious or compromised Ceph monitor, or an on-path attacker on an unsigned or unencrypted messenger session, can send a crafted MDS map and trigger the invalid read in the client kernel. For the CVSS the PR:N is used because the attacker does not need a local account on the victim and only needs network ability to influence the Ceph monitor session. The issue is network reachable in Ceph deployments where the client accepts MDS maps from the affected monitor path, although such traffic is usually inside a storage or data center network rather than the public Internet. Impact is at least denial of service via kernel crash. In the paranoid score it may allow limited confidentiality or integrity impact due to the out-of-bounds read and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.