Linux CephFS client: unbounded copy of MDSCapAuth path and fs_name crashes client at mount

Impact

handle_session() copies the match.path and match.fs_name byte strings from a CEPH_SESSION_OPEN message with a bare ceph_decode_copy() and no preceding bounds check, and the enclosing struct_len fields are skipped rather than enforced. A length field up to 4 GiB makes the client read that far past the message front allocation, crashing the node with an out-of-bounds read - reported by KASAN as slab-out-of-bounds in handle_session(). This fires on the first post-connect message at mount time, with no user interaction, so a hostile MDS can take down every client that tries to mount. On a GPU fleet that mounts CephFS for datasets or checkpoints, that is a fleet-wide denial of service triggered by the storage control plane rather than by any tenant.

Who can reach it

A malicious or compromised Ceph MDS responding to a client's session open, or an on-path attacker on an unauthenticated messenger session. No credentials on the client side and no local user needed - the mount itself is the trigger.

What to do

Patch the host kernel to a stable release that switches both copies to ceph_decode_copy_safe() (commits below), then drain and reboot each CephFS client node. Before patching, limit exposure by ensuring clients only reach trusted MDS daemons and by running msgr2 in secure mode so sessions cannot be hijacked on-path. No vendor fixed-version string is given in the record beyond the stable commits.

References

Related entries

• Linux nfsd: use-after-free on an nfs4_client freed during NFSv4.0 revoked-state cleanupCVE-2026-89658 · Linux NFS server (nfsd, nfs40_clean_admin_revoked client refcounting)Unscored
• Linux nfsd: use-after-free when a client is torn down while an expired delegation is being revokedCVE-2026-89659 · Linux NFS server (nfsd, revoke_delegation / nfs4_laundromat client lifetime)Unscored
• Linux nfsd: use-after-free on an nfs4_client freed while admin state revocation drops client_lockCVE-2026-89660 · Linux NFS server (nfsd, nfsd4_revoke_states / revoke_one_stid client lifetime)Unscored
• Linux nfsd: writing unlock_filesystem after server shutdown walks freed state tables (use-after-free)CVE-2026-89661 · Linux NFS server (nfsd, /proc/fs/nfsd/unlock_filesystem -> nfsd4_cancel_copy_by_sb)Unscored
• Linux nfsd: lock owner freed by the laundromat while client teardown walks it, causing a NULL dereferenceCVE-2026-89662 · Linux NFS server (nfsd, __destroy_client lock-owner teardown / remove_blocked_locks)Unscored
• Linux nfsd: copy-notify stateid freed while still discoverable, a use-after-free on all three revoke pathsCVE-2026-89663 · Linux NFS server (nfsd, copy-notify stateids in s2s_cp_stateids / _free_cpntf_state_locked)Unscored