CVE-2026-89650
A bug in the CephFS client kernel could let a malicious monitor send a crafted MDS map that causes an out‑of‑bounds read. The issue occurs when the monitor supplies an oversized num_export_targets field in a per‑MDS info record. The kernel now checks the bounds before decoding, preventing the read.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel CephFS clients on any system that uses CephFS with kernel support.
Real-world impact
An attacker could trigger a kernel out‑of‑bounds read, potentially crashing the system or providing a foothold for further exploitation. The read itself does not leak data directly but can be used to destabilize the kernel.
Why this severity
The CVSS score of 9.1 reflects a critical vulnerability that is network‑exposed, low complexity, requires no privileges or user interaction, and can lead to a kernel crash or privilege escalation.
What to do about it
- 01Update the Linux kernel to a version that includes the fix for CVE-2026-89650.
NVD description indicates fix
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.