CVE-2026-89649: ceph: bound xattr value length in __build_xattrs()
Published Sep 11, 2026
·Updated
ceph: bound xattr value length in buildxattrs()
Affected Software
2 affected componentsFixes available
Linux Linux kernel
Microsoft azl3 kernel 6.6.152.1-1<6.6.157.1-1
6.6.157.1-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Sep 11, 2026
CVE Published
via MITRE·07:45 PM
Data Sourced
via MITRE·07:45 PM
DescriptionSeverity
Data Sourced
via NVD·08:19 PM
DescriptionSeverity
Sep 13, 2026
Data Sourced
via Microsoft·08:04 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Which systems are exposed to this issue?
Systems using the Linux kernel Ceph client are exposed when they receive extended-attribute data from a malicious or compromised Ceph Metadata Server (MDS). The malformed data is delivered in an MDS-supplied xattr blob.
2
What must an attacker control to trigger the flaw?
An attacker needs to control or compromise the metadata server sufficiently to provide an xattr blob whose final attribute declares a value length larger than the remaining bytes in the blob. The issue specifically relies on the missing bounds check for the last attribute's value bytes.