GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89657 (GCVE-0-2026-89657)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-14 12:01
VLAI
Title
libceph: validate OSD extent maps before cursor advance
Summary
In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osd_client.c:osd_sparse_read() validates that the sparse-read data length matches the summed extent lengths, but it does not validate that each OSD-supplied extent is monotonic and lies inside the original request range. A malformed authenticated OSD reply can advertise a far-forward nonzero extent offset with a matching data length and make the client advance the message-data cursor beyond the request buffer. This reaches the BUG_ON(!*length) assertion in ceph_msg_data_next() from the client receive path. Impact: A malicious or compromised authenticated Ceph OSD peer can crash a kernel Ceph client via a malformed sparse-read reply. Reject sparse extent maps that overflow, move backwards, overlap, or extend outside the original sparse-read request before advancing the cursor. [ idryomov: perform sparse_extent_map_valid() check a bit earlier, in CEPH_SPARSE_READ_DATA_LEN instead of CEPH_SPARSE_READ_DATA_PRE state ]
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f628d799972799023d32c2542bb2639eb8c4f84e , < 94ae5145c520618802b0a24c047dcd5f05835db8 (git)
Affected: f628d799972799023d32c2542bb2639eb8c4f84e , < 058ffa81f9440c5b4714685611cf697fd3739ec9 (git)
Affected: f628d799972799023d32c2542bb2639eb8c4f84e , < 2571b35883268a266554e80d368e67fdfea7fb9d (git)
Affected: f628d799972799023d32c2542bb2639eb8c4f84e , < 201db408872ca12cf09e36bf0f560138c3dcfa1c (git)
Affected: f628d799972799023d32c2542bb2639eb8c4f84e , < 9ec08b7499a62c6d4afa93d36ab47a43fcad57d1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/osd_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "94ae5145c520618802b0a24c047dcd5f05835db8",
              "status": "affected",
              "version": "f628d799972799023d32c2542bb2639eb8c4f84e",
              "versionType": "git"
            },
            {
              "lessThan": "058ffa81f9440c5b4714685611cf697fd3739ec9",
              "status": "affected",
              "version": "f628d799972799023d32c2542bb2639eb8c4f84e",
              "versionType": "git"
            },
            {
              "lessThan": "2571b35883268a266554e80d368e67fdfea7fb9d",
              "status": "affected",
              "version": "f628d799972799023d32c2542bb2639eb8c4f84e",
              "versionType": "git"
            },
            {
              "lessThan": "201db408872ca12cf09e36bf0f560138c3dcfa1c",
              "status": "affected",
              "version": "f628d799972799023d32c2542bb2639eb8c4f84e",
              "versionType": "git"
            },
            {
              "lessThan": "9ec08b7499a62c6d4afa93d36ab47a43fcad57d1",
              "status": "affected",
              "version": "f628d799972799023d32c2542bb2639eb8c4f84e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/osd_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: validate OSD extent maps before cursor advance\n\nnet/ceph/osd_client.c:osd_sparse_read() validates that the sparse-read\ndata length matches the summed extent lengths, but it does not validate\nthat each OSD-supplied extent is monotonic and lies inside the original\nrequest range. A malformed authenticated OSD reply can advertise a\nfar-forward nonzero extent offset with a matching data length and make\nthe client advance the message-data cursor beyond the request buffer.\nThis reaches the BUG_ON(!*length) assertion in ceph_msg_data_next() from\nthe client receive path.\n\nImpact: A malicious or compromised authenticated Ceph OSD peer can crash\na kernel Ceph client via a malformed sparse-read reply.\n\nReject sparse extent maps that overflow, move backwards, overlap, or\nextend outside the original sparse-read request before advancing the\ncursor.\n\n[ idryomov: perform sparse_extent_map_valid() check a bit earlier,\n  in CEPH_SPARSE_READ_DATA_LEN instead of CEPH_SPARSE_READ_DATA_PRE\n  state ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The malformed sparse-read extent map is consumed in osd_sparse_read() on the Ceph messenger TCP receive path (messenger_v1/v2) when a kernel CephFS client handles an MOSDOpReply from a remote OSD; no local syscall or ioctl is required to parse the reply.\nAC:L - A malicious OSD fully controls the sparse extent offsets and lengths and can advertise a far-forward nonzero extent with a matching data length, deterministically advancing the message-data cursor past the request buffer into BUG_ON(!*length) in ceph_msg_data_next() with no race or special memory layout.\nPR:N - The attacker acts as a remote Ceph OSD peer on a compromised or attacker-controlled cluster and needs no account, capabilities, or user-namespace privileges on the victim Linux host; any kernel CephFS client connected to that cluster is exposed.\nUI:N - Once CephFS is mounted with fscrypt-encrypted files or the sparseread option, netfs/buffered reads and encrypted RMW writes issue CEPH_OSD_OP_SPARSE_READ as normal I/O; the OSD can crash the client on the next such reply without further victim action at exploit time.\nS:U - The BUG_ON panic occurs in the kernel Ceph client\u0027s receive path on the same host and does not cross a VM, IOMMU, or sandbox boundary to another security authority.\nC:N - ceph_msg_data_next() hits BUG_ON(!*length) and related cursor assertions when the buffer is exhausted, before any out-of-bounds page access; there is no use-after-free, OOB read, or other information-disclosure primitive.\nI:N - Cursor over-advance is stopped by BUG_ON assertions rather than writing past the allocated request pages; hole-zeroing via zero_user_segment stays inside the destination buffer until the panic, so there is no arbitrary kernel write or control-flow hijack.\nA:H - BUG_ON(!*length) in ceph_msg_data_next() on the client receive path causes a kernel oops or panic, fully denying availability of the affected Ceph client host until reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:01:51.323Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/94ae5145c520618802b0a24c047dcd5f05835db8"
        },
        {
          "url": "https://git.kernel.org/stable/c/058ffa81f9440c5b4714685611cf697fd3739ec9"
        },
        {
          "url": "https://git.kernel.org/stable/c/2571b35883268a266554e80d368e67fdfea7fb9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/201db408872ca12cf09e36bf0f560138c3dcfa1c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ec08b7499a62c6d4afa93d36ab47a43fcad57d1"
        }
      ],
      "title": "libceph: validate OSD extent maps before cursor advance",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89657",
    "datePublished": "2026-09-11T19:45:46.118Z",
    "dateReserved": "2026-09-11T19:38:34.743Z",
    "dateUpdated": "2026-09-14T12:01:51.323Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89657",
      "date": "2026-09-16",
      "epss": "0.00603",
      "percentile": "0.4727"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:56:47.000Z",
      "cve": "CVE-2026-89657",
      "id": "msrc_CVE-2026-89657",
      "initial_release_date": "2026-09-13T01:09:54.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "libceph: validate OSD extent maps before cursor advance",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89657.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89657\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:51.940\",\"lastModified\":\"2026-09-14T13:19:18.230\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlibceph: validate OSD extent maps before cursor advance\\n\\nnet/ceph/osd_client.c:osd_sparse_read() validates that the sparse-read\\ndata length matches the summed extent lengths, but it does not validate\\nthat each OSD-supplied extent is monotonic and lies inside the original\\nrequest range. A malformed authenticated OSD reply can advertise a\\nfar-forward nonzero extent offset with a matching data length and make\\nthe client advance the message-data cursor beyond the request buffer.\\nThis reaches the BUG_ON(!*length) assertion in ceph_msg_data_next() from\\nthe client receive path.\\n\\nImpact: A malicious or compromised authenticated Ceph OSD peer can crash\\na kernel Ceph client via a malformed sparse-read reply.\\n\\nReject sparse extent maps that overflow, move backwards, overlap, or\\nextend outside the original sparse-read request before advancing the\\ncursor.\\n\\n[ idryomov: perform sparse_extent_map_valid() check a bit earlier,\\n  in CEPH_SPARSE_READ_DATA_LEN instead of CEPH_SPARSE_READ_DATA_PRE\\n  state ]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ceph/osd_client.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f628d799972799023d32c2542bb2639eb8c4f84e\",\"lessThan\":\"94ae5145c520618802b0a24c047dcd5f05835db8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f628d799972799023d32c2542bb2639eb8c4f84e\",\"lessThan\":\"058ffa81f9440c5b4714685611cf697fd3739ec9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f628d799972799023d32c2542bb2639eb8c4f84e\",\"lessThan\":\"2571b35883268a266554e80d368e67fdfea7fb9d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f628d799972799023d32c2542bb2639eb8c4f84e\",\"lessThan\":\"201db408872ca12cf09e36bf0f560138c3dcfa1c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f628d799972799023d32c2542bb2639eb8c4f84e\",\"lessThan\":\"9ec08b7499a62c6d4afa93d36ab47a43fcad57d1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ceph/osd_client.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/058ffa81f9440c5b4714685611cf697fd3739ec9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/201db408872ca12cf09e36bf0f560138c3dcfa1c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2571b35883268a266554e80d368e67fdfea7fb9d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/94ae5145c520618802b0a24c047dcd5f05835db8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9ec08b7499a62c6d4afa93d36ab47a43fcad57d1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-13T06:51:18+00:00",
      "cve": "CVE-2026-89657",
      "id": "CVE-2026-89657",
      "initial_release_date": "2026-09-11T19:45:46.118000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: libceph: Denial of Service in Linux kernel via malformed sparse-read replies",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89657.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:00:58Z",
      "cve": "CVE-2026-89657",
      "id": "CVE-2026-89657",
      "initial_release_date": "2026-09-12T16:24:07Z",
      "product_status:known_affected": "168",
      "product_status:known_not_affected": "185",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89657",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89657.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.