CVE-2026-89651

The Linux kernel's Ceph filesystem client contains an out-of-bounds read in handle_session(): when decoding MDSCapAuth records from a CEPH_SESSION_OPEN message (msg_version >= 6), the match.path and match.fs_name strings are copied using the unchecked ceph_decode_copy() after reading an attacker-controlled 32-bit length, with no ceph_decode_need() bounds check and no enforcement of the MDSCapAuth/MDSCapMatch struct_len limits. A malicious or compromised Ceph metadata server (MDS) can trigger this with the first post-connect message at mount time, before any client-side user interaction, forcing the kernel to read up to 4 GiB past the kvmalloc'd message-front allocation and crashing the client (reported under KASAN as a slab-out-of-bounds read). The attacker gains a denial-of-service against any host using the in-kernel Ceph client, since the flaw is in session setup itself; the assigned CVSS 3.1 score is 9.8 (critical). Affected systems are Linux hosts running the kernel CephFS client (CONFIG_CEPH_FS) that mount Ceph filesystems, particularly where the client connects to MDS servers that are untrusted or could be compromised. No public proof of concept is known and there is no indication of exploitation in the wild.

What to do: Update to a kernel containing the fix (which uses ceph_decode_copy_safe() for match.path and match.fs_name in handle_session()) as soon as your distribution ships it, and verify the patched package is actually loaded on all hosts that mount CephFS. Until then, treat MDS servers as trust anchors: only mount cephfs against known-good clusters, restrict network access to MDS ports so clients cannot reach untrusted or potentially compromised metadata servers, and disable unattended/auto-mounting of Ceph filesystems from untrusted sources. Watch for client-side kernel oopses or KASAN slab-out-of-bounds reports in handle_session() as an indicator of attempted triggering.