CVE-2026-89653

A flaw was found in the Linux kernel's Ceph file system client. When decoding metadata server maps (MDSMap), the client fails to properly validate rank identifiers within export targets against protocol limits. A malicious or compromised Ceph storage monitor can send a crafted map that triggers an out-of-bounds write to a stack buffer. This flaw can lead to kernel memory corruption or a system crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as Important because a rogue or compromised Ceph monitor can trigger stack-based memory corruption in the client kernel, potentially leading to a denial of service or arbitrary code execution. Exposure is limited to systems that actively mount Ceph filesystem shares using the in-kernel driver and communicate with untrusted or compromised storage cluster monitors. Typical Red Hat Enterprise Linux and OpenShift deployments that do not use the in-kernel CephFS client are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue on systems where the kernel Ceph filesystem is not required, prevent the ceph module from being loaded:

1. Create a configuration file to disable autoloading of the module:

echo "install ceph /bin/true" > /etc/modprobe.d/disable-ceph.conf

2. If the module is currently loaded, unload it:

modprobe -r ceph

Warning: If the module is actively in use by mounted filesystems, unloading will fail and a system reboot is required to ensure the configuration takes effect.

Caveats: This workaround completely disables the in-kernel CephFS driver, preventing the host from mounting Ceph file storage. Userspace clients such as ceph-fuse are unaffected.