CVE-2026-89657

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

libceph: validate OSD extent maps before cursor advance

net/ceph/osd_client.c:osd_sparse_read() validates that the sparse-read

data length matches the summed extent lengths, but it does not validate

that each OSD-supplied extent is monotonic and lies inside the original

request range. A malformed authenticated OSD reply can advertise a

far-forward nonzero extent offset with a matching data length and make

the client advance the message-data cursor beyond the request buffer.

This reaches the BUG_ON(!*length) assertion in ceph_msg_data_next() from

the client receive path.

Impact: A malicious or compromised authenticated Ceph OSD peer can crash

a kernel Ceph client via a malformed sparse-read reply.

Reject sparse extent maps that overflow, move backwards, overlap, or

extend outside the original sparse-read request before advancing the

cursor.

[ idryomov: perform sparse_extent_map_valid() check a bit earlier,

in CEP

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References