Linux libceph: malformed CRUSH map aliases bucket workspaces and overflows the permutation buffer

UnscoredCVE-2026-89656Kernel, userspace & hypervisorcurated

Impact

crush_decode() stores buckets by array slot while the mapper derives each bucket's workspace index from the decoded bucket id, so a map that encodes an id other than -1 - slot makes one bucket reuse another's workspace. For uniform buckets, second-replica selection expands the larger source bucket's permutation into the smaller aliased buffer and the write can run past the kvmalloc'd CRUSH workspace - KASAN reports a 4-byte slab out-of-bounds write in bucket_perm_choose(). On a GPU node with kernel RBD or CephFS mounts this is kernel heap corruption in the storage path, realistically a node crash. Valid CRUSH maps already use canonical negative ids, so the fix rejects mismatched ids without changing behaviour for well-formed maps.

Who can reach it

Not reachable from a tenant pod. Requires the ability to feed the client a malformed OSD/CRUSH map, i.e. control of the Ceph monitors or the storage network path the client trusts.

What to do

Update to a stable kernel carrying the fix (four backport commits linked on the record) and drain and reboot each node with a kernel Ceph client; libceph cannot be swapped under live mounts. Batch with the other libceph fixes published the same day. No configuration change avoids it.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-89656 https://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24 https://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd https://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.