CVE-2026-89651

A flaw was found in the Linux kernel's Ceph client. An out-of-bounds read vulnerability exists in the handle_session() function when decoding MDSCapAuth records. A malicious or compromised Metadata Server (MDS) can trigger this during session setup without client-side user interaction. This can force the kernel client to read past the message buffer, leading to a client crash and a Denial of Service (DoS).

A remote out-of-bounds read exists in the Ceph kernel client MDS session handling path because handle_session decodes MDSCapAuth match path and fs_name strings with ceph_decode_copy without first checking that the requested length is still inside the message front buffer. A malicious or compromised MDS can trigger this with a crafted CEPH_SESSION_OPEN message during session setup, including the first post-connect message on mount. For the CVSS the PR:N is used because the attacker does not need privileges on the client system and only needs to be reachable as the MDS endpoint or to tamper with that MDS traffic. The issue is network reachable in Ceph deployments where the client connects to an attacker controlled or compromised MDS, but Ceph clusters are usually located on internal storage or data center networks rather than the public Internet. Impact is at least remote denial of service via kernel crash. In the paranoid score, limited confidentiality or integrity impact is kept because kernel memory can be read past the message allocation and copied into cap authorization state, but there is no clear arbitrary write primitive in the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.