CVE-2026-89653: ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
ceph: reject exporttargets ranks >= CEPHMAXMDS in mdsmap decode
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
Who can trigger the out-of-bounds write?
The affected client-side MDS map decoding path consumes export_targets entries controlled by a Ceph monitor. Exploitation requires a monitor to provide an export target rank outside the CEPH_MAX_MDS protocol namespace.
Does temporarily lowering max_mds prevent the issue?
No. Maps may legitimately reference ranks beyond a temporarily reduced max_mds, so validation must use CEPH_MAX_MDS rather than possible_max_rank.
What is the remediation?
Use a kernel containing the fix that rejects export_targets ranks greater than or equal to CEPH_MAX_MDS during MDS map decoding. The supplied references identify stable kernel commits carrying the change.