Linux libceph: malformed OSD sparse-read reply advances the message cursor past the request buffer and panics

UnscoredCVE-2026-89657Kernel, userspace & hypervisorcurated

Impact

osd_sparse_read() checks that the sparse-read data length matches the summed extent lengths but never checks that each OSD-supplied extent is monotonic and lies inside the original request range. A reply advertising a far-forward extent offset with a matching data length drives the message-data cursor beyond the request buffer and reaches the BUG_ON(!*length) in ceph_msg_data_next() on the receive path. The record states the impact plainly: a malicious or compromised authenticated OSD can crash a kernel Ceph client. On a GPU node with RBD or CephFS mounted this is an unplanned node loss and the death of whatever job was resident - denial of service, with no indication of memory disclosure or code execution.

Who can reach it

Requires an authenticated Ceph OSD peer - a compromised OSD, or an attacker able to impersonate one on the storage network. Not reachable from a tenant workload on the node.

What to do

Update to a stable kernel carrying the fix (four backport commits linked on the record); the fix rejects sparse extent maps that overflow, move backwards, overlap, or extend outside the request. Drain and reboot each node with a kernel Ceph client - libceph cannot be reloaded under a live mount. Batch with the other libceph fixes from the same day.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-89657 https://git.kernel.org/stable/c/058ffa81f9440c5b4714685611cf697fd3739ec9 https://git.kernel.org/stable/c/201db408872ca12cf09e36bf0f560138c3dcfa1c https://git.kernel.org/stable/c/2571b35883268a266554e80d368e67fdfea7fb9d

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.