CVE-2026-89653
A critical bug in the Linux kernel's Ceph integration could let an attacker corrupt memory by using an out-of-range rank when decoding a Ceph MDS map. The flaw allows arbitrary code execution with no privileges. The issue has been fixed in recent kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users running Ceph clusters are affected, particularly those using the Ceph client component that decodes MDS maps.
Real-world impact
An attacker could exploit the bug to execute arbitrary code on the system, potentially taking full control of the affected machine.
Why this severity
The CVSS score of 9.8 reflects that a remote attacker can run arbitrary code without authentication or user interaction, and the vulnerability compromises confidentiality, integrity, and availability.
What to do about it
- 01Upgrade your Linux kernel to a version that includes the fix for CVE-2026-89653.
- 02Verify the kernel version after the upgrade.
NVD-referenced vendor advisory
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.