CVE-2026-89650: ceph: bound num_export_targets array for mds info v2/v3
ceph: bound numexporttargets array for mds info v2/v3
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel clients using Ceph are exposed when they process CEPH_MSG_MDS_MAP messages containing per-MDS information records with version 2 or 3. The affected parsing occurs in the kernel Ceph client while decoding MDS maps received through its monitor session.
What access does an attacker need to trigger the out-of-bounds read?
An attacker would need to control or compromise a Ceph monitor, or be able to modify traffic on an unsigned and unencrypted messenger session. They can send an MDS map with an oversized num_export_targets value in a version 2 or 3 per-MDS record.
What can be done while a kernel update is pending?
Using signed and encrypted messenger sessions prevents the described on-path attacker from altering MDS map traffic. This does not protect against a malicious or compromised monitor, which can send the malformed map directly.
How might this appear during investigation?
The condition causes an out-of-bounds read in the client kernel while decoding MDS map export targets. On x86_64 systems with KASAN enabled, it is reported as a slab-out-of-bounds read.