CVE-2026-89652: ceph: bound copied dentry name length in NFS export get_name
In the Linux kernel, the following vulnerability has been resolved:
ceph: bound copied dentry name length in NFS export getname
cephgetname() copies the MDS-supplied name into the caller's NAMEMAX-sized buffer with memcpy(name, rinfo->dname, rinfo->dnamelen) and then writes name[rinfo->dnamelen] = 0, without checking dnamelen against NAMEMAX. A malicious or buggy MDS that returns a LOOKUPNAME reply with dnamelen > NAMEMAX overflows the buffer. getsnapname() copies rde->name / rde->namelen the same unchecked way.
Impact: a malicious or compromised Ceph MDS overflows the NAMEMAX name buffer in a client's NFS-export getname path, a slab out-of-bounds write reported by KASAN. Reachable when a CephFS mount is re-exported over NFS.
Add cephexportcopyname(), which rejects lengths above NAMEMAX with -ENAMETOOLONG before the copy, and use it in both cephgetname() and getsnapname().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.157 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.109 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.50 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
CephFS clients are exposed when their CephFS mount is re-exported over NFS and the NFS-export get_name path is reached. The issue depends on an MDS supplying an oversized name in a LOOKUPNAME reply.
What does an attacker need to exploit it?
An attacker would need to control, compromise, or otherwise cause a Ceph MDS to return a LOOKUPNAME reply whose dname_len exceeds NAME_MAX. A buggy MDS that produces such a reply can also trigger the out-of-bounds write.
What can be done if the fix cannot be applied immediately?
Avoid re-exporting CephFS mounts over NFS, which removes the stated reachable path. Restrict trust and access to Ceph MDS instances so untrusted or compromised MDS responses cannot reach clients.
How can this issue be detected?
The described failure is a slab out-of-bounds write in the client's NFS-export get_name path and was reported by KASAN. Investigation should focus on CephFS mounts re-exported through NFS and MDS LOOKUPNAME replies with name lengths greater than NAME_MAX.