Linux CephFS client: unbounded delegated-inode intervals let a hostile MDS burn client CPU and memory

Impact

ceph_parse_deleg_inos() decodes attacker-controlled 64-bit interval lengths from an MDS create-with-delegation reply and loops over them inserting entries into the session xarray, with no bound on a single interval, on the number of intervals per reply, or on the accumulated count across replies. A malicious or compromised MDS can pin a client CPU in the insert loop or grow the xarray until the node runs out of memory. On a GPU node this is a resource-exhaustion denial of service driven entirely by the storage control plane: the node stops making progress on training work and typically has to be rebooted to recover. The fix caps the per-session population and the aggregate interval length accepted from one reply.

Who can reach it

A malicious or compromised Ceph MDS serving a client that performs async file creates on a CephFS mount. No local user action beyond ordinary file creation, and no client-side authentication bypass needed.

What to do

Patch the host kernel to a stable release carrying the CEPH_MAX_DELEG_INOS cap (commits below) and drain and reboot each node mounting CephFS. As an interim measure, ensure clients only mount from trusted MDS daemons. The record names no vendor fixed-version string beyond the stable commits.

References

Related entries

• Linux CephFS client: unchecked final xattr value length leaks kernel heap via getxattr(2)CVE-2026-89649 · Linux kernel CephFS client (__build_xattrs xattr value length)Unscored
• Linux CephFS client: out-of-bounds read decoding MDS map info v2/v3 export targetsCVE-2026-89650 · Linux kernel CephFS client (ceph_mdsmap_decode num_export_targets)Unscored
• Linux CephFS client: unbounded copy of MDSCapAuth path and fs_name crashes client at mountCVE-2026-89651 · Linux kernel CephFS client (handle_session MDSCapAuth path/fs_name decode)Unscored
• Linux nfsd: use-after-free on an nfs4_client freed during NFSv4.0 revoked-state cleanupCVE-2026-89658 · Linux NFS server (nfsd, nfs40_clean_admin_revoked client refcounting)Unscored
• Linux nfsd: use-after-free when a client is torn down while an expired delegation is being revokedCVE-2026-89659 · Linux NFS server (nfsd, revoke_delegation / nfs4_laundromat client lifetime)Unscored
• Linux nfsd: use-after-free on an nfs4_client freed while admin state revocation drops client_lockCVE-2026-89660 · Linux NFS server (nfsd, nfsd4_revoke_states / revoke_one_stid client lifetime)Unscored