CVE-2026-89650: ceph: bound num_export_targets array for mds info v2/v3
In the Linux kernel, the following vulnerability has been resolved:
ceph: bound numexporttargets array for mds info v2/v3
cephmdsmapdecode() in fs/ceph/mdsmap.c reads numexporttargets from each per-mds info record and advances the decode cursor by numexporttargets sizeof(u32) without first checking that many bytes remain. The only upper-bound check that catches a runaway cursor (p > infoend) is gated on infov >= 4, because infoend is left NULL for infov 2 and 3. When the monitor sends an MDS map whose per-mds info version is 2 or 3 with an oversized numexporttargets, the cursor moves past the message front buffer and the later export-targets loop calls the unchecked cephdecode32() on out-of-bounds memory.
A kernel client processes CEPHMSGMDSMAP from its monitor session (net/ceph/monclient.c dispatches it; fs/ceph/super.c routes it to cephmdschandlemdsmap(), which sets end to the front buffer bound and calls cephmdsmapdecode()). A malicious or compromised monitor, or an on-path attacker on an unsigned/unencrypted messenger session, can therefore drive an out-of-bounds read in the client kernel; on x8664 with KASAN it is reported as a slab-out-of-bounds read in cephmdsmapdecode(). The decoded values land in the internal info->exporttargets[] array, so the consequence is a kernel out-of-bounds read, not an information leak to the attacker.
Impact: a malicious or compromised Ceph monitor sending an MDS map with a per-mds info version of 2 or 3 and an oversized numexporttargets field triggers an out-of-bounds read in the CephFS client kernel.
Add a cephdecodeneed() for the export-targets array before advancing the cursor, so the bound is enforced for every infov >= 2, not only infov >= 4. This mirrors the count-then-need idiom already used for mdatapgpools later in the same function.
Compute the export-targets byte count with sizemul() and reuse that checked length when advancing the cursor, so the attacker-controlled numexporttargets multiplication fails closed on overflow rather than relying on the later kcalloc() guard.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel clients using Ceph are exposed when they process CEPH_MSG_MDS_MAP messages containing per-MDS information records with version 2 or 3. The affected parsing occurs in the kernel Ceph client while decoding MDS maps received through its monitor session.
What access does an attacker need to trigger the out-of-bounds read?
An attacker would need to control or compromise a Ceph monitor, or be able to modify traffic on an unsigned and unencrypted messenger session. They can send an MDS map with an oversized num_export_targets value in a version 2 or 3 per-MDS record.
What can be done while a kernel update is pending?
Using signed and encrypted messenger sessions prevents the described on-path attacker from altering MDS map traffic. This does not protect against a malicious or compromised monitor, which can send the malformed map directly.
How might this appear during investigation?
The condition causes an out-of-bounds read in the client kernel while decoding MDS map export targets. On x86_64 systems with KASAN enabled, it is reported as a slab-out-of-bounds read.