CVE-2026-89656

The Linux kernel's Ceph client library (libceph) contains a heap out-of-bounds write in bucket_perm_choose() that is reached when decoding a malformed CRUSH map: a bucket whose encoded id does not match its array slot can alias another bucket's workspace, and for uniform buckets the permutation expansion writes past the smaller bucket's array and can escape the kvmalloc'd CRUSH workspace. The malicious map is delivered to a host running the kernel Ceph client (e.g., kernel CephFS mounts or RBD via kclient), typically from a malicious or compromised Ceph monitor, giving the attacker kernel memory corruption with only a 4-byte overflow reported by KASAN but potentially sufficient for a kernel crash (denial of service) or privilege escalation. Any Linux host that consumes CRUSH maps from a cluster it connects to is affected, and CVSS 3.1 rates it 9.8 critical (network vector, no privileges or user interaction required). No public proof of concept exists and the issue is not in CISA's KEV, so exploitation status is none known. The fix rejects any bucket whose encoded id does not match its slot, which does not change behavior for valid maps.

What to do: Patch kernel Ceph client hosts (kernel CephFS and RBD users first) as soon as a kernel build containing the crush_decode fix is available from your distribution. Because the malicious input comes from the cluster's CRUSH map, restrict clients to trusted, cephx-authenticated monitors and firewall monitor ports so a compromised or spoofed monitor cannot reach kernel clients. If a patched kernel is not yet available for affected hosts, consider switching those workloads to the userspace Ceph client as a stopgap.