CVE-2026-89656: libceph: reject buckets with mismatched CRUSH ids
In the Linux kernel, the following vulnerability has been resolved:
libceph: reject buckets with mismatched CRUSH ids
crushdecode() stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket reuse another bucket's workspace by encoding an id different from -1 - slot.
For uniform buckets, the second replica selection expands the source bucket's permutation into that aliased workspace buffer. If the source bucket is larger than the aliased bucket, the write runs past the smaller permutation array and can escape the kvmalloc'd CRUSH workspace. KASAN reports a slab OOB write of 4 bytes in bucketpermchoose().
Reject buckets whose encoded id does not match their array slot. Valid CRUSH maps already use the canonical negative id corresponding to the bucket slot, so this restores the invariant expected by work->work[-1 - in->id] without changing valid map behavior.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control to trigger the out-of-bounds write?
An attacker would need to supply or cause the client to decode a malformed CRUSH map containing a bucket whose encoded ID does not match the canonical negative ID for its array slot. The overflow occurs during replica selection when a larger uniform bucket aliases the workspace allocated for a smaller bucket.
Are normally configured CRUSH maps affected?
Valid CRUSH maps use the canonical negative bucket ID corresponding to the bucket slot. The fix rejects only mismatched bucket IDs and does not change behavior for valid maps.
What is the impact of successful exploitation?
The malformed map can cause a 4-byte slab out-of-bounds write in bucket_perm_choose(). The write can escape the kvmalloc-allocated CRUSH workspace when the source bucket is larger than the bucket whose workspace is incorrectly reused.
How can administrators identify exposure from CRUSH map contents?
Inspect decoded or supplied CRUSH maps for bucket IDs that differ from the canonical value of -1 minus the bucket's array slot. Such a mismatch is the condition the fix rejects.