CVE-2026-89652

A flaw was found in the Linux kernel's Ceph file system. A malicious or compromised Ceph Metadata Server (MDS) can send a specially crafted LOOKUPNAME reply that causes a buffer overflow when copying dentry names during an NFS export operation. This out-of-bounds write can lead to memory corruption on the client system, particularly when a CephFS mount is re-exported over NFS.

A buffer overflow flaw was found in the Linux kernel's Ceph file system, rated IMPORTANT by Red Hat. It affects the kernel shipped in Red Hat Enterprise Linux 7, 8, 9, and 10, Red Hat In-Vehicle OS, and Red Hat OpenShift Container Platform (through the RHEL CoreOS kernels); fixes for the affected products are being pursued. Red Hat Enterprise Linux 6 is not affected because its kernel does not contain the vulnerable code, which was introduced upstream in kernel 3.15.

In ceph_get_name() and __get_snap_name(), the dentry name supplied by a Ceph Metadata Server (MDS) in a LOOKUPNAME reply is copied into a NAME_MAX-sized buffer using memcpy() without first checking the supplied length against NAME_MAX. A malicious or compromised MDS that returns a reply with a name length greater than NAME_MAX therefore causes a slab out-of-bounds write in the client's kernel memory. The vulnerable path is reachable when a CephFS mount is re-exported over NFS, so systems in that configuration are exposed to kernel memory corruption, which can lead to a system crash (denial of service) or other memory-corruption consequences. The upstream fix adds a length check that rejects names longer than NAME_MAX with -ENAMETOOLONG before the copy is performed.

The upstream CVE record rates this flaw CRITICAL (CVSS 9.8, network attack vector, no privileges required), while Red Hat rates it IMPORTANT (CVSS 7.0, local attack vector, high attack complexity). The lower Red Hat severity reflects that the out-of-bounds write occurs in the client's local kernel memory and that exploitation requires both a malicious or compromised MDS and a client whose CephFS mount is re-exported over NFS, conditions that significantly reduce practical exploitability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.