CVE-2026-90067: libceph: validate banner payload length
In the Linux kernel, the following vulnerability has been resolved:
libceph: validate banner payload length
When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length socket read. This violates an invariant in the state machine, triggering a warning in populateiniter():
------------[ cut here ]------------ !iovitercount(&con->v2.initer) WARNING: net/ceph/messengerv2.c:3129 at populateiniter net/ceph/messengerv2.c:3129 [inline], CPU#1: kworker/1:3/5070 WARNING: net/ceph/messengerv2.c:3129 at cephconv2tryread+0x6634/0x6810 net/ceph/messengerv2.c:3159, CPU#1: kworker/1:3/5070 ... Call Trace: <TASK> cephconworkfn+0x1f5/0x14a0 net/ceph/messenger.c:1575 processonework kernel/workqueue.c:3322 [inline] processscheduledworks+0xa8e/0x14e0 kernel/workqueue.c:3405 workerthread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 retfromfork+0x514/0xb70 arch/x86/kernel/process.c:158 retfromforkasm+0x1a/0x30 arch/x86/entry/entry64.S:245 </TASK>
According to the msgr2 protocol specification, the banner payload is expected to contain at least two 64-bit integers (serverfeat and serverreqfeat). Therefore, payloadlen must be at least 16 bytes.
Fix this by adding a check in processbannerprefix() to reject a payloadlen smaller than 16 bytes. This prevents the 0-length read and correctly aborts the connection with a protocol error.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add a check in `process_banner_prefix()` to reject banner payloads where `payload_len` is 0 or smaller than 16 bytes, so `populate_in_iter()` does not set up a 0-length socket read and the connection is aborted with a protocol error.
Linux kernel (Ceph messenger v2) process_banner_prefix() validation = Reject msgr2 banner payload_len values smaller than 16 bytes (and payload_len=0)
Event History
Frequently Asked Questions
Where can maintainers find the upstream stable fixes?
The provided references identify three stable commits: 279c0852999fd2384f4a88155091a99e81f96873, 6cf666e47f2b51d5a887ec8a3226cde951757d27, and 3b2e62a7655d347a845a91155610ddae11daffc6.
Which kernel release versions are known to include the fix?
The available data does not specify affected or fixed Linux Kernel version ranges. Compare your kernel source or vendor patch set with the referenced stable commits.