CVE-2026-89649
A bug in the Linux kernel’s CephFS extended‑attribute handling lets a malicious metadata server cause a buffer overflow when a user calls getxattr(2). The flaw occurs because the final attribute’s value length is not checked against the blob bounds, allowing an out‑of‑bounds read that can leak kernel memory. The issue has been fixed by adding a bounds check in the kernel code.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users running CephFS, particularly those that rely on extended attributes via getxattr(2).
Real-world impact
An attacker who controls a Ceph metadata server could read arbitrary kernel memory and potentially gain information or privileges on the host system.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability is exploitable over the network, requires no privileges, and can lead to complete data disclosure (confidentiality and integrity).
What to do about it
- 01Upgrade your Linux kernel to a version that includes the CephFS bounds‑check fix for CVE-2026-89649.
- 02Reboot or reload the kernel to activate the new version.
NVD-referenced vendor advisory
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.