CVE-2026-89652

The Linux kernel's CephFS client contains an out-of-bounds write in the NFS export get_name path: ceph_get_name() and __get_snap_name() memcpy the metadata server (MDS)-supplied filename into a NAME_MAX-sized buffer without first validating its length, then write a NUL terminator past the end. A malicious or compromised Ceph MDS can trigger this by returning a LOOKUPNAME reply whose dname_len exceeds NAME_MAX, producing a slab out-of-bounds write detected by KASAN, with potential for kernel memory corruption and privilege escalation or a system crash on the client. The vulnerable path is only reachable when a CephFS mount is re-exported over NFS (e.g., via NFS-Ganesha or knfsd), and the attacker must control or have compromised the MDS, which is normally a trusted cluster component. The fix introduces ceph_export_copy_name(), which rejects names longer than NAME_MAX with -ENAMETOOLONG before copying. No public proof of concept is known and the flaw is not listed in CISA's KEV catalog.

What to do: Apply a kernel update containing ceph_export_copy_name() as soon as your distribution ships it. Until then, avoid re-exporting CephFS mounts over NFS or ensure only fully trusted, hardened MDS servers can serve LOOKUPNAME replies to NFS-exporting clients. Check for KASAN 'out-of-bounds write' reports and unexplained client kernel crashes on hosts in the CephFS-NFS re-export path, and treat any MDS compromise as a potential client kernel compromise.