Linux CephFS client: unchecked dentry name length overflows a NAME_MAX buffer in the NFS re-export path

Impact

ceph_get_name() memcpy's an MDS-supplied name into a NAME_MAX-sized caller buffer without checking dname_len, and then writes a NUL one byte past it; __get_snap_name() copies rde->name the same way. An MDS that returns a LOOKUPNAME reply with an oversized name produces a slab out-of-bounds write in the client, reported by KASAN. On a GPU node this is a kernel-memory corruption in the storage path: the realistic outcome is a node crash that takes resident jobs with it, and corruption of adjacent slab objects cannot be ruled out. Exposure is narrow - the path is only reached when a CephFS mount is re-exported over NFS - so fleets that mount CephFS directly on compute nodes without re-export are not on this code path.

Who can reach it

Not reachable from a tenant pod. Requires a malicious or compromised Ceph MDS (or something able to forge MDS replies on the storage network) talking to a client that re-exports a CephFS mount over NFS.

What to do

Update to a stable kernel carrying the fix; four backport commits are linked on the record. A mounted kernel CephFS client cannot be swapped in place, so this is a drain and reboot per node - batch it with the other libceph/ceph fixes published the same day. As an interim mitigation, stopping the NFS re-export of CephFS removes the reachable path.

References

Related entries

• Linux CephFS client: out-of-range MDS rank in mdsmap export_targets writes past a stack bitmapCVE-2026-89653 · Linux kernel CephFS client (mdsmap decode, export_targets rank validation)Unscored
• Linux CephFS client: use-after-free on an MDS session freed while check_new_map drops mdsc->mutexCVE-2026-89654 · Linux kernel CephFS client (check_new_map, MDS session refcounting)Unscored
• Linux CephFS client: use-after-free when a cap-flush entry is freed by a fast FLUSH_ACK mid-iterationCVE-2026-89655 · Linux kernel CephFS client (__kick_flushing_caps, cap flush list iteration)Unscored
• Linux libceph: malformed CRUSH map aliases bucket workspaces and overflows the permutation bufferCVE-2026-89656 · Linux kernel libceph (crush_decode, bucket id vs array slot validation)Unscored
• Linux libceph: malformed OSD sparse-read reply advances the message cursor past the request buffer and panicsCVE-2026-89657 · Linux kernel libceph (osd_sparse_read, sparse extent map validation)Unscored
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical