CVE-2026-89652
A flaw in the Linux kernel's Ceph NFS-export path can allow a malicious or buggy Ceph metadata server to send an overlong name, causing a buffer overflow when a CephFS mount is re-exported over NFS. The issue is critical (CVSS 9.8) and can affect confidentiality, integrity, and availability.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Systems running the affected Linux kernel code path for CephFS mounts that are re-exported over NFS. No affected product versions are listed in the provided data.
Real-world impact
A slab out-of-bounds write may occur in a client handling a CephFS mount re-exported over NFS.
Why this severity
CVSS 9.8 is critical. The vulnerability can be exploited remotely with low complexity, requires no privileges or user interaction, and has high impact on confidentiality, integrity, and availability.
What to do about it
- 01Update the Linux kernel on systems that use CephFS mounts re-exported over NFS to a release containing the documented resolution for CVE-2026-89652.
NVD description: the vulnerability is marked resolved; the fix adds ceph_export_copy_name() to reject names longer than NAME_MAX before copying them.
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.