Linux CephFS client: out-of-bounds read decoding MDS map info v2/v3 export targets

Impact

ceph_mdsmap_decode() advances the decode cursor by num_export_targets * 4 bytes without checking that many bytes remain, and the only guard that would catch the runaway cursor is gated on info version 4 or higher. A monitor that sends an MDS map with per-mds info version 2 or 3 and an oversized count drives an out-of-bounds read in the client kernel, reported under KASAN as a slab-out-of-bounds in ceph_mdsmap_decode(). The decoded values land in an internal array, so the result is a client kernel crash rather than a leak to the attacker - but a crash here takes down every CephFS mount on the node, which on a GPU node means killing in-flight training jobs and forcing a reboot. MDS maps arrive unsolicited from the monitor session, so no tenant action is needed to trigger it.

Who can reach it

A malicious or compromised Ceph monitor, or an on-path attacker on an unsigned and unencrypted messenger session, sending a crafted CEPH_MSG_MDS_MAP to a mounting client. No client-side authentication or user interaction required.

What to do

Patch the host kernel to a stable release carrying the added ceph_decode_need() and size_mul() bound in ceph_mdsmap_decode() (commits below), then drain and reboot each node mounting CephFS. Interim mitigation is restricting which monitors clients can reach and running msgr2 in secure mode so an on-path attacker cannot forge the map. The record names no vendor fixed-version string beyond the stable commits.

References

Related entries

• Linux CephFS client: unbounded copy of MDSCapAuth path and fs_name crashes client at mountCVE-2026-89651 · Linux kernel CephFS client (handle_session MDSCapAuth path/fs_name decode)Unscored
• Linux nfsd: use-after-free on an nfs4_client freed during NFSv4.0 revoked-state cleanupCVE-2026-89658 · Linux NFS server (nfsd, nfs40_clean_admin_revoked client refcounting)Unscored
• Linux nfsd: use-after-free when a client is torn down while an expired delegation is being revokedCVE-2026-89659 · Linux NFS server (nfsd, revoke_delegation / nfs4_laundromat client lifetime)Unscored
• Linux nfsd: use-after-free on an nfs4_client freed while admin state revocation drops client_lockCVE-2026-89660 · Linux NFS server (nfsd, nfsd4_revoke_states / revoke_one_stid client lifetime)Unscored
• Linux nfsd: writing unlock_filesystem after server shutdown walks freed state tables (use-after-free)CVE-2026-89661 · Linux NFS server (nfsd, /proc/fs/nfsd/unlock_filesystem -> nfsd4_cancel_copy_by_sb)Unscored
• Linux nfsd: lock owner freed by the laundromat while client teardown walks it, causing a NULL dereferenceCVE-2026-89662 · Linux NFS server (nfsd, __destroy_client lock-owner teardown / remove_blocked_locks)Unscored