Look up another CVE · open CVE-2026-89651 in the interactive tracker
CVE-2026-89651
ceph: bound MDSCapAuth path and fs_name decode in handle_session()
Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem fs/ceph. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-89651 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
handle_session() decodes the MDSCapAuth records carried by a CEPH_SESSION_OPEN message (msg_version >= 6). For each record the match.path and match.fs_name byte strings are read by first decoding a 32-bit length and then copying that many bytes with the bare ceph_decode_copy(). Unlike the surrounding fields, which all use the _safe decode variants, these two copies are not preceded by a ceph_decode_need() bounds check, and the enclosing MDSCapAuth and MDSCapMatch struct_len fields are skipped rather than enforced as an upper bound. A length larger than the bytes remaining in the message front makes ceph_decode_copy() read past the end of the front buffer. The message front is a dedicated allocation (ceph_msg_new2() -> kvmalloc), so the over-read runs off that object. A malicious or compromised MDS can trigger this with the first post-connect message on mount, with no client-side user interaction; under KASAN it is reported as a slab-out-of-bounds read in handle_session(). Impact: a malicious MDS can force the kernel client to read up to 4 GiB past the message front allocation during session setup, crashing the client (out-of-bounds read). Switch both copies to ceph_decode_copy_safe(), which performs the ceph_decode_need() bounds check before the copy and branches to the existing bad label, matching the rest of the decoder and the error path that frees the partially decoded cap_auths array.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/ceph/mds_client.c
- What this is
- CEPH DISTRIBUTED FILE SYSTEM CLIENT (CEPH)MAINTAINERS section matched on fs/ceph/ · ceph-devel@vger.kernel.org · Supported
- Kernel module
- ceph
Check it on the machine
grep -w CONFIG_CEPH_FS /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w cephPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sid, bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switch
- CONFIG_CEPH_FS
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-11 (37 days ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.64%, higher than 49.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- fs/ceph
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.10 | 6.12.109 | dc5c7dffda92 |
| 6.10 | 6.18.50 | c37db86d2b5e |
| 6.10 | 7.2.4 | 5f892c767b30 |
| 6.10 | 7.3 | 77933e22adfe |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- CEPH_MSG_CLIENT_SESSION arrives over the kernel Ceph messenger TCP session from an MDS peer; mds_dispatch() hands it to handle_session(), so a malicious or compromised MDS (or on-path attacker on an unsigned msgr session) reaches the unbounded decode with network data alone.
- AC:LAttack complexity, low
- The attacker fully controls msg->hdr.version and the MDSCapAuth path/fs_name u32 lengths; setting version>=6 and a length larger than remaining front bytes (or UINT_MAX) deterministically hits the unchecked ceph_decode_copy() with no race or layout dependency.
- PR:NPrivileges required, none
- Exploitation requires only sending a crafted CEPH_SESSION_OPEN as the remote MDS peer on an established session; the attacker needs no account, capability, or mount privilege on the victim beyond the client already being connected to that cluster.
- UI:NUser interaction, none
- Once CephFS is mounted (standard in Rook/Kubernetes/OpenStack), the MDS emits CEPH_SESSION_OPEN as the first post-connect message on mount or reconnect, processed automatically in the ceph-msgr kworker with no further victim action at exploit time.
- S:UScope, unchanged
- The out-of-bounds read and any resulting kernel memory corruption stay inside the victim host's CephFS client kernel; they do not cross a VM, sandbox, or IOMMU security boundary.
- C:HConfidentiality impact, high
- Unchecked ceph_decode_copy() of an attacker-chosen u32 length reads past the kvmalloc'd message front into adjacent kernel memory and stores those bytes in match.path/match.fs_name; unbounded out-of-bounds reads are High per kernel guidance.
- I:HIntegrity impact, high
- Attacker-controlled _len is both the memcpy size and kcalloc(_len+1) count, so UINT_MAX wraps the allocation to ZERO_SIZE_PTR and the copy writes from address 16; over-read bytes are also installed as cap-auth path/fs_name used by ceph_mds_check_access, a memory-corruption primitive.
- A:HAvailability impact, high
- The over-read runs off the dedicated message-front object and can fault on unmapped pages or vmalloc guard pages, oopsing the ceph-msgr worker as KASAN reported; a malicious MDS can repeat this on every session open.