Linux CephFS client: out-of-range MDS rank in mdsmap export_targets writes past a stack bitmap

Impact

MDSMap export_targets entries come from the Ceph monitors and are used directly as bit numbers against a fixed-size stack bitmap in check_new_map(). A rank outside CEPH_MAX_MDS makes set_bit() write past the end of that array - a stack out-of-bounds write in the client kernel. The practical outcome on a GPU node with a kernel CephFS mount is an unplanned crash; stack corruption of this kind is not cheaply bounded, so treat it as more than a hang. The fix rejects ranks outside CEPH_MAX_MDS at decode time rather than at use, and deliberately does not validate against possible_max_rank, since maps may legitimately reference ranks above a temporarily reduced max_mds.

Who can reach it

Not reachable from a tenant on the node. Requires control of, or the ability to forge maps from, the Ceph monitors that the client trusts - i.e. an attacker already on the storage control path.

What to do

Update to a stable kernel carrying the fix (four backport commits linked on the record) and reboot each node holding a kernel CephFS mount; the client cannot be reloaded under a live mount. Batch with the other ceph/libceph fixes from the same day to spend one maintenance window instead of several. No configuration change avoids it.

References

Related entries

• Linux CephFS client: use-after-free on an MDS session freed while check_new_map drops mdsc->mutexCVE-2026-89654 · Linux kernel CephFS client (check_new_map, MDS session refcounting)Unscored
• Linux CephFS client: use-after-free when a cap-flush entry is freed by a fast FLUSH_ACK mid-iterationCVE-2026-89655 · Linux kernel CephFS client (__kick_flushing_caps, cap flush list iteration)Unscored
• Linux libceph: malformed CRUSH map aliases bucket workspaces and overflows the permutation bufferCVE-2026-89656 · Linux kernel libceph (crush_decode, bucket id vs array slot validation)Unscored
• Linux libceph: malformed OSD sparse-read reply advances the message cursor past the request buffer and panicsCVE-2026-89657 · Linux kernel libceph (osd_sparse_read, sparse extent map validation)Unscored
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical