Linux CephFS client: unchecked final xattr value length leaks kernel heap via getxattr(2)

Impact

A malicious or compromised Ceph MDS can set the last xattr's value length larger than the bytes actually present in the decoded blob. __set_xattr() stores the oversized length verbatim, and a later getxattr(2) memcpy's past the end of the kvmalloc allocation into a user-supplied buffer, disclosing adjacent kernel heap bytes to any local user on the client. On a GPU node that mounts CephFS for datasets or checkpoints, that is a kernel memory disclosure reachable by any tenant process that can stat a file on the share - useful for defeating KASLR or lifting neighbouring data. The precondition is a hostile or compromised metadata server, so the blast radius is the whole set of clients mounting that filesystem.

Who can reach it

A malicious or compromised Ceph MDS (or an on-path attacker on an unsigned, unencrypted messenger session) supplies the crafted xattr blob; any local unprivileged user on the client then calls getxattr(2) on a CephFS file to receive the leaked bytes. No authentication beyond being an ordinary local user on the mounting node.

What to do

Patch the host kernel to a stable release containing the added ceph_decode_need() check in __build_xattrs() (commits linked below) and reboot each node that mounts CephFS; the ceph module is in use by a live mount, so this is a drain-and-reboot, not a live module reload. Until then, the practical mitigation is ensuring only trusted MDS daemons are reachable and that messenger sessions are authenticated and encrypted (msgr2 secure mode). No vendor-assigned fixed version string is in the record beyond the stable commits.

References

Related entries

• Linux CephFS client: out-of-bounds read decoding MDS map info v2/v3 export targetsCVE-2026-89650 · Linux kernel CephFS client (ceph_mdsmap_decode num_export_targets)Unscored
• Linux CephFS client: unbounded copy of MDSCapAuth path and fs_name crashes client at mountCVE-2026-89651 · Linux kernel CephFS client (handle_session MDSCapAuth path/fs_name decode)Unscored
• Linux nfsd: use-after-free on an nfs4_client freed during NFSv4.0 revoked-state cleanupCVE-2026-89658 · Linux NFS server (nfsd, nfs40_clean_admin_revoked client refcounting)Unscored
• Linux nfsd: use-after-free when a client is torn down while an expired delegation is being revokedCVE-2026-89659 · Linux NFS server (nfsd, revoke_delegation / nfs4_laundromat client lifetime)Unscored
• Linux nfsd: use-after-free on an nfs4_client freed while admin state revocation drops client_lockCVE-2026-89660 · Linux NFS server (nfsd, nfsd4_revoke_states / revoke_one_stid client lifetime)Unscored
• Linux nfsd: writing unlock_filesystem after server shutdown walks freed state tables (use-after-free)CVE-2026-89661 · Linux NFS server (nfsd, /proc/fs/nfsd/unlock_filesystem -> nfsd4_cancel_copy_by_sb)Unscored