CVE-2026-89656

A flaw was found in libceph within the Linux kernel. This vulnerability allows a local attacker to craft a malformed CRUSH map, which is used for data placement. By doing so, one data bucket can be made to reuse another bucket's memory workspace, leading to an out-of-bounds write. This memory corruption could result in a denial of service or potentially lead to privilege escalation.

This vulnerability is rated as Important severity because heap-based memory corruption in the Linux kernel can cause kernel panics or enable privilege escalation when handling an invalid data placement map. The flaw is confined to environments utilizing the libceph driver, which is only loaded when Ceph block devices or network file systems are actively configured. On typical Red Hat Enterprise Linux installations that do not act as Ceph storage clients, the relevant module remains uninitialized, preventing exposure under default conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the libceph kernel module from loading by blacklisting it, provided that Ceph storage client services are not required on the host.

1. Add a configuration file to prevent the module from loading: echo "install libceph /bin/true" > /etc/modprobe.d/disable-libceph.conf

2. If the module is currently loaded and idle, unload it: modprobe -r libceph

Warning: If the module is actively in use by running processes or mounts, it cannot be unloaded dynamically and a system restart is required for this workaround to take effect.

Caveats: Disabling libceph prevents the host from utilizing kernel-space Ceph features, including mounting CephFS file systems and mapping RADOS Block Devices (RBD). Do not implement this workaround on hosts that require Ceph storage connectivity.