GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89648 (GCVE-0-2026-89648)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-13 06:32
VLAI
Title
ceph: cap delegated inode count in ceph_parse_deleg_inos()
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: cap delegated inode count in ceph_parse_deleg_inos() ceph_parse_deleg_inos() decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with ceph_decode_64_safe(), which only validates that the eight bytes are present in the message, not the value, and then loops over len while inserting entries into s_delegated_inos. len is fully attacker controlled. A malicious or compromised MDS can send one huge interval, many intervals in one reply, duplicate intervals, or repeated replies that accumulate delegated inodes on the same session. The original code bounded none of these and could spin the insert loop or grow the xarray without limit. Bound both dimensions with a single enforcement point. Track the number of delegated inodes held by each MDS session in an atomic counter and grow it only in ceph_insert_deleg_ino(), which uses atomic_add_unless() to refuse to push the count past CEPH_MAX_DELEG_INOS. Because that helper is the only place the counter grows, the per-session population can never exceed the cap, so no separate per-session pre-check is needed. The counter is decremented when async create consumes a delegated inode or when an insert fails, incremented when a delegated inode is restored, initialized with the session xarray, and reset when reconnect destroys the xarray. A per-session cap alone still lets one reply spin the insert loop on duplicate ranges without growing the counter, so also cap the aggregate interval length accepted from a single reply. Together these bound both the loop trip count per reply and the xarray population across replies. The cap is a fixed, client-chosen constant rather than a value derived from the MDS. mds_client_prealloc_inos is a userspace MDS configuration option; it is never sent to the kernel client on the wire, and a server-supplied bound could not be trusted for a defensive limit in any case. The constant is set well above that option's documented default of 1000 (a generous multiple), so legitimate refill behavior is unaffected while the CPU and xarray memory a malformed delegation stream can consume stays bounded. Impact: a malicious or compromised Ceph MDS can no longer make a client spin through an unbounded delegated-inode interval or grow one session's delegated-inode xarray without limit.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d4846487870897a5a149a3220c95bfd5728f9247 , < c040e139f1a629b767f900bbbc3f9892c290ed85 (git)
Affected: d4846487870897a5a149a3220c95bfd5728f9247 , < f341270ac5f5077804d7837ce77b0f0df1cea29d (git)
Affected: d4846487870897a5a149a3220c95bfd5728f9247 , < 4bd3158bd62466d57ed72a3f7bc5f205fedd6919 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/mds_client.c",
            "fs/ceph/mds_client.h",
            "fs/ceph/super.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c040e139f1a629b767f900bbbc3f9892c290ed85",
              "status": "affected",
              "version": "d4846487870897a5a149a3220c95bfd5728f9247",
              "versionType": "git"
            },
            {
              "lessThan": "f341270ac5f5077804d7837ce77b0f0df1cea29d",
              "status": "affected",
              "version": "d4846487870897a5a149a3220c95bfd5728f9247",
              "versionType": "git"
            },
            {
              "lessThan": "4bd3158bd62466d57ed72a3f7bc5f205fedd6919",
              "status": "affected",
              "version": "d4846487870897a5a149a3220c95bfd5728f9247",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/mds_client.c",
            "fs/ceph/mds_client.h",
            "fs/ceph/super.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: cap delegated inode count in ceph_parse_deleg_inos()\n\nceph_parse_deleg_inos() decodes interval sets of delegated inode numbers\nfrom an MDS create-with-delegation reply. For each set it reads a 64-bit\nstart and a 64-bit len with ceph_decode_64_safe(), which only validates\nthat the eight bytes are present in the message, not the value, and then\nloops over len while inserting entries into s_delegated_inos.\n\nlen is fully attacker controlled. A malicious or compromised MDS can send\none huge interval, many intervals in one reply, duplicate intervals, or\nrepeated replies that accumulate delegated inodes on the same session.\nThe original code bounded none of these and could spin the insert loop or\ngrow the xarray without limit.\n\nBound both dimensions with a single enforcement point. Track the number\nof delegated inodes held by each MDS session in an atomic counter and\ngrow it only in ceph_insert_deleg_ino(), which uses atomic_add_unless()\nto refuse to push the count past CEPH_MAX_DELEG_INOS. Because that helper\nis the only place the counter grows, the per-session population can never\nexceed the cap, so no separate per-session pre-check is needed. The\ncounter is decremented when async create consumes a delegated inode or\nwhen an insert fails, incremented when a delegated inode is restored,\ninitialized with the session xarray, and reset when reconnect destroys\nthe xarray.\n\nA per-session cap alone still lets one reply spin the insert loop on\nduplicate ranges without growing the counter, so also cap the aggregate\ninterval length accepted from a single reply. Together these bound both\nthe loop trip count per reply and the xarray population across replies.\n\nThe cap is a fixed, client-chosen constant rather than a value derived\nfrom the MDS. mds_client_prealloc_inos is a userspace MDS configuration\noption; it is never sent to the kernel client on the wire, and a\nserver-supplied bound could not be trusted for a defensive limit in any\ncase. The constant is set well above that option\u0027s documented default of\n1000 (a generous multiple), so legitimate refill behavior is unaffected\nwhile the CPU and xarray memory a malformed delegation stream can consume\nstays bounded.\n\nImpact: a malicious or compromised Ceph MDS can no longer make a client\nspin through an unbounded delegated-inode interval or grow one session\u0027s\ndelegated-inode xarray without limit."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ceph_parse_deleg_inos() runs in the ceph-msgr kworker via mds_dispatch()-\u003ehandle_reply()-\u003eparse_reply_info() while decoding CEPH_MSG_CLIENT_REPLY extra data over TCP; on Ceph/Rook/Kubernetes nodes with CephFS mounted, a malicious or compromised MDS drives this remotely.\nAC:L - The MDS fully controls the 64-bit interval len (ceph_decode_64_safe only checks that 8 bytes exist) and can advertise CEPHFS_FEATURE_DELEG_INO at session open. One crafted create-style reply with a huge or duplicate range deterministically spins xa_insert or grows s_delegated_inos on ordinary 64-bit CephFS clients.\nPR:N - The attacker is the remote MDS peer on an already-connected kernel CephFS client and needs no Linux UID, capability, or init-namespace root on the victim, matching other MDS-reply client CVEs such as CVE-2026-80528.\nUI:N - Once CephFS is mounted, MDS replies are processed automatically in kworker context. parse_reply_info_extra selects the create decoder from the reply\u0027s attacker-controlled op field, so ordinary outstanding MDS traffic is enough; no further interactive victim action is required at exploit time.\nS:U - Impact is CPU and kernel-memory exhaustion inside the local CephFS client; it does not cross a VM, hypervisor, IOMMU, or other security-authority boundary.\nC:N - The loop only inserts the fixed DELEGATED_INO_AVAILABLE marker into s_delegated_inos or retries on -EBUSY; there is no out-of-bounds read, use-after-free, or other kernel-memory disclosure primitive.\nI:N - xa_insert is used as a well-defined API storing a constant tagged value; the bug does not yield an arbitrary write, type confusion, or control-flow hijack, only unbounded legitimate xarray growth and CPU spinning.\nA:H - An attacker-chosen 64-bit len can iterate without cond_resched(), soft-lockup the ceph-msgr worker (especially on duplicate ranges that return -EBUSY), and unbounded GFP_KERNEL xa_insert growth can exhaust kernel memory and hang or OOM the client."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:32:26.851Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c040e139f1a629b767f900bbbc3f9892c290ed85"
        },
        {
          "url": "https://git.kernel.org/stable/c/f341270ac5f5077804d7837ce77b0f0df1cea29d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bd3158bd62466d57ed72a3f7bc5f205fedd6919"
        }
      ],
      "title": "ceph: cap delegated inode count in ceph_parse_deleg_inos()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89648",
    "datePublished": "2026-09-11T19:45:39.375Z",
    "dateReserved": "2026-09-11T19:38:34.742Z",
    "dateUpdated": "2026-09-13T06:32:26.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89648",
      "date": "2026-09-15",
      "epss": "0.00609",
      "percentile": "0.47372"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:56:24.000Z",
      "cve": "CVE-2026-89648",
      "id": "msrc_CVE-2026-89648",
      "initial_release_date": "2026-09-13T01:09:27.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ceph: cap delegated inode count in ceph_parse_deleg_inos()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89648.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89648\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:50.760\",\"lastModified\":\"2026-09-13T07:17:29.997\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: cap delegated inode count in ceph_parse_deleg_inos()\\n\\nceph_parse_deleg_inos() decodes interval sets of delegated inode numbers\\nfrom an MDS create-with-delegation reply. For each set it reads a 64-bit\\nstart and a 64-bit len with ceph_decode_64_safe(), which only validates\\nthat the eight bytes are present in the message, not the value, and then\\nloops over len while inserting entries into s_delegated_inos.\\n\\nlen is fully attacker controlled. A malicious or compromised MDS can send\\none huge interval, many intervals in one reply, duplicate intervals, or\\nrepeated replies that accumulate delegated inodes on the same session.\\nThe original code bounded none of these and could spin the insert loop or\\ngrow the xarray without limit.\\n\\nBound both dimensions with a single enforcement point. Track the number\\nof delegated inodes held by each MDS session in an atomic counter and\\ngrow it only in ceph_insert_deleg_ino(), which uses atomic_add_unless()\\nto refuse to push the count past CEPH_MAX_DELEG_INOS. Because that helper\\nis the only place the counter grows, the per-session population can never\\nexceed the cap, so no separate per-session pre-check is needed. The\\ncounter is decremented when async create consumes a delegated inode or\\nwhen an insert fails, incremented when a delegated inode is restored,\\ninitialized with the session xarray, and reset when reconnect destroys\\nthe xarray.\\n\\nA per-session cap alone still lets one reply spin the insert loop on\\nduplicate ranges without growing the counter, so also cap the aggregate\\ninterval length accepted from a single reply. Together these bound both\\nthe loop trip count per reply and the xarray population across replies.\\n\\nThe cap is a fixed, client-chosen constant rather than a value derived\\nfrom the MDS. mds_client_prealloc_inos is a userspace MDS configuration\\noption; it is never sent to the kernel client on the wire, and a\\nserver-supplied bound could not be trusted for a defensive limit in any\\ncase. The constant is set well above that option\u0027s documented default of\\n1000 (a generous multiple), so legitimate refill behavior is unaffected\\nwhile the CPU and xarray memory a malformed delegation stream can consume\\nstays bounded.\\n\\nImpact: a malicious or compromised Ceph MDS can no longer make a client\\nspin through an unbounded delegated-inode interval or grow one session\u0027s\\ndelegated-inode xarray without limit.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ceph/mds_client.c\",\"fs/ceph/mds_client.h\",\"fs/ceph/super.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d4846487870897a5a149a3220c95bfd5728f9247\",\"lessThan\":\"c040e139f1a629b767f900bbbc3f9892c290ed85\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d4846487870897a5a149a3220c95bfd5728f9247\",\"lessThan\":\"f341270ac5f5077804d7837ce77b0f0df1cea29d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d4846487870897a5a149a3220c95bfd5728f9247\",\"lessThan\":\"4bd3158bd62466d57ed72a3f7bc5f205fedd6919\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ceph/mds_client.c\",\"fs/ceph/mds_client.h\",\"fs/ceph/super.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4bd3158bd62466d57ed72a3f7bc5f205fedd6919\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c040e139f1a629b767f900bbbc3f9892c290ed85\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f341270ac5f5077804d7837ce77b0f0df1cea29d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T16:47:08+00:00",
      "cve": "CVE-2026-89648",
      "id": "CVE-2026-89648",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "234",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89648.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:01:13Z",
      "cve": "CVE-2026-89648",
      "id": "CVE-2026-89648",
      "initial_release_date": "2026-09-16T00:01:13Z",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "93",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89648",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89648.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.