CVE-2026-89657

A flaw was found in libceph in the Linux kernel. A malicious or compromised authenticated Ceph Object Storage Device (OSD) peer could send a specially crafted sparse-read reply that lacks proper validation of extent maps. This could cause the client to advance its message-data cursor beyond the request buffer, leading to a kernel crash and a Denial of Service (DoS).

A malformed authenticated Ceph OSD sparse-read reply can provide an invalid extent map that is not monotonic or does not stay inside the original request range. The client may then advance the message data cursor beyond the request buffer and reach BUG_ON in ceph_msg_data_next from the receive path, causing a kernel crash. For the CVSS the PR:H is used because practical triggering requires a malicious or compromised authenticated Ceph OSD peer rather than only unauthenticated network access to the client. The issue is network reachable within Ceph storage or data center networks where the client accepts replies from OSD peers. Impact is at least denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.