CVE-2026-89653

The Linux kernel's Ceph filesystem client contains an out-of-bounds write when decoding the MDSMap sent by the Ceph monitor cluster. The export_targets entries are monitor-controlled and are used as bit numbers into a fixed-size stack bitmap in check_new_map(), so a rank value at or above CEPH_MAX_MDS causes set_bit() to write past the end of the array, corrupting kernel stack memory. An attacker who controls or compromises the Ceph monitors serving a client can push a crafted MDSMap and achieve kernel memory corruption — potentially code execution — on any host mounting that CephFS filesystem, reflected in a critical 9.8 CVSS score. Only Linux systems using the in-kernel Ceph client (CONFIG_CEPH_FS) that mount CephFS from a monitor cluster are affected, and exploitation requires attacker influence over the monitor side, which limits the practical attack surface to clients of a malicious or compromised cluster. No public proof of concept exists, the flaw is not in CISA's KEV catalog, and no exploitation has been reported.

What to do: Apply distribution kernel updates that include the fix rejecting export_targets ranks >= CEPH_MAX_MDS during MDSMap decode, and prioritize hosts with active CephFS mounts. Enforce cephx authentication on all Ceph clusters and restrict network access to monitor ports (3300/6789) so clients only accept maps from authenticated, trusted monitors. Monitor client hosts for kernel oops reports in ceph mdsmap decoding / check_new_map as an indicator of malicious map injection.