CVE-2026-89653: ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
In the Linux kernel, the following vulnerability has been resolved:
ceph: reject exporttargets ranks >= CEPHMAXMDS in mdsmap decode
MDSMap exporttargets entries are monitor controlled. checknewmap() uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can make setbit() write past the end of the array.
Reject ranks outside CEPHMAXMDS while decoding the map. Do not validate against possiblemaxrank here because maps may legitimately reference ranks beyond a temporarily reduced maxmds.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the out-of-bounds write?
The affected client-side MDS map decoding path consumes export_targets entries controlled by a Ceph monitor. Exploitation requires a monitor to provide an export target rank outside the CEPH_MAX_MDS protocol namespace.
Does temporarily lowering max_mds prevent the issue?
No. Maps may legitimately reference ranks beyond a temporarily reduced max_mds, so validation must use CEPH_MAX_MDS rather than possible_max_rank.
What is the remediation?
Use a kernel containing the fix that rejects export_targets ranks greater than or equal to CEPH_MAX_MDS during MDS map decoding. The supplied references identify stable kernel commits carrying the change.