CVE-2026-89650

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ceph: bound num_export_targets array for mds info v2/v3

ceph_mdsmap_decode() in fs/ceph/mdsmap.c reads num_export_targets from

each per-mds info record and advances the decode cursor by

num_export_targets * sizeof(u32) without first checking that many bytes

remain. The only upper-bound check that catches a runaway cursor

(*p > info_end) is gated on info_v >= 4, because info_end is left NULL

for info_v 2 and 3. When the monitor sends an MDS map whose per-mds

info version is 2 or 3 with an oversized num_export_targets, the cursor

moves past the message front buffer and the later export-targets loop

calls the unchecked ceph_decode_32() on out-of-bounds memory.

A kernel client processes CEPH_MSG_MDS_MAP from its monitor session

(net/ceph/mon_client.c dispatches it; fs/ceph/super.c routes it to

ceph_mdsc_handle_mdsmap(), which sets end to the front buffer bound and

calls ceph_mdsmap_decode()). A malicious or compromised

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References