Vulnerability-Lookup

GHSA-QWCM-8GH9-XC6H

Vulnerability from github – Published: 2026-09-11 21:31 – Updated: 2026-09-14 15:32

Details

In the Linux kernel, the following vulnerability has been resolved:

libceph: reject buckets with mismatched CRUSH ids

crush_decode() stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket reuse another bucket's workspace by encoding an id different from -1 - slot.

For uniform buckets, the second replica selection expands the source bucket's permutation into that aliased workspace buffer. If the source bucket is larger than the aliased bucket, the write runs past the smaller permutation array and can escape the kvmalloc'd CRUSH workspace. KASAN reports a slab OOB write of 4 bytes in bucket_perm_choose().

Reject buckets whose encoded id does not match their array slot. Valid CRUSH maps already use the canonical negative id corresponding to the bucket slot, so this restores the invariant expected by work->work[-1 - in->id] without changing valid map behavior.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-89656"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-11T20:19:51Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject buckets with mismatched CRUSH ids\n\ncrush_decode() stores bucket data by array slot, and the mapper later\nderives the per-bucket workspace index from the decoded bucket id. A\nmalformed map can therefore make one bucket reuse another bucket\u0027s\nworkspace by encoding an id different from -1 - slot.\n\nFor uniform buckets, the second replica selection expands the source\nbucket\u0027s permutation into that aliased workspace buffer. If the source\nbucket is larger than the aliased bucket, the write runs past the smaller\npermutation array and can escape the kvmalloc\u0027d CRUSH workspace. KASAN\nreports a slab OOB write of 4 bytes in bucket_perm_choose().\n\nReject buckets whose encoded id does not match their array slot. Valid\nCRUSH maps already use the canonical negative id corresponding to the\nbucket slot, so this restores the invariant expected by\nwork-\u003ework[-1 - in-\u003eid] without changing valid map behavior.",
  "id": "GHSA-qwcm-8gh9-xc6h",
  "modified": "2026-09-14T15:32:33Z",
  "published": "2026-09-11T21:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89656"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4aeb93daadf388e72073abc204312dd364eeb30a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/79900d978158b2d80eef952fc41b9e4dc58d7b83"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/baad5875fdd2f5e248250fc3519bb045d64f1716"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-89656 (GCVE-0-2026-89656)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-14 12:01

Title

libceph: reject buckets with mismatched CRUSH ids

Summary

In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crush_decode() stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the decoded bucket id. A malformed map can therefore make one bucket reuse another bucket's workspace by encoding an id different from -1 - slot. For uniform buckets, the second replica selection expands the source bucket's permutation into that aliased workspace buffer. If the source bucket is larger than the aliased bucket, the write runs past the smaller permutation array and can escape the kvmalloc'd CRUSH workspace. KASAN reports a slab OOB write of 4 bytes in bucket_perm_choose(). Reject buckets whose encoded id does not match their array slot. Valid CRUSH maps already use the canonical negative id corresponding to the bucket slot, so this restores the invariant expected by work->work[-1 - in->id] without changing valid map behavior.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/ee59040d6ed1a5f8d…
https://git.kernel.org/stable/c/baad5875fdd2f5e24…
https://git.kernel.org/stable/c/4aeb93daadf388e72…
https://git.kernel.org/stable/c/6e5c6ce252b1eccfd…
https://git.kernel.org/stable/c/3516a4131c4e45d62…
https://git.kernel.org/stable/c/00562ccd4e88d092b…
https://git.kernel.org/stable/c/79900d978158b2d80…
https://git.kernel.org/stable/c/3cde4a83023016799…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 66a0e2d579dbec5c676cfe446234ffebb267c564 , < ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a (git) Affected: 66a0e2d579dbec5c676cfe446234ffebb267c564 , < baad5875fdd2f5e248250fc3519bb045d64f1716 (git) Affected: 66a0e2d579dbec5c676cfe446234ffebb267c564 , < 4aeb93daadf388e72073abc204312dd364eeb30a (git) Affected: 66a0e2d579dbec5c676cfe446234ffebb267c564 , < 6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022 (git) Affected: 66a0e2d579dbec5c676cfe446234ffebb267c564 , < 3516a4131c4e45d62ee4e42e82c36930e8c1fbbd (git) Affected: 66a0e2d579dbec5c676cfe446234ffebb267c564 , < 00562ccd4e88d092b9b851df50fad20442bfeb24 (git) Affected: 66a0e2d579dbec5c676cfe446234ffebb267c564 , < 79900d978158b2d80eef952fc41b9e4dc58d7b83 (git) Affected: 66a0e2d579dbec5c676cfe446234ffebb267c564 , < 3cde4a8302301679937474a5f7a851394cc1bd11 (git)
Linux	Linux	Affected: 4.11 Unaffected: 0 , < 4.11 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.109 , ≤ 6.12.* (semver) Unaffected: 6.18.50 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/osdmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a",
              "status": "affected",
              "version": "66a0e2d579dbec5c676cfe446234ffebb267c564",
              "versionType": "git"
            },
            {
              "lessThan": "baad5875fdd2f5e248250fc3519bb045d64f1716",
              "status": "affected",
              "version": "66a0e2d579dbec5c676cfe446234ffebb267c564",
              "versionType": "git"
            },
            {
              "lessThan": "4aeb93daadf388e72073abc204312dd364eeb30a",
              "status": "affected",
              "version": "66a0e2d579dbec5c676cfe446234ffebb267c564",
              "versionType": "git"
            },
            {
              "lessThan": "6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022",
              "status": "affected",
              "version": "66a0e2d579dbec5c676cfe446234ffebb267c564",
              "versionType": "git"
            },
            {
              "lessThan": "3516a4131c4e45d62ee4e42e82c36930e8c1fbbd",
              "status": "affected",
              "version": "66a0e2d579dbec5c676cfe446234ffebb267c564",
              "versionType": "git"
            },
            {
              "lessThan": "00562ccd4e88d092b9b851df50fad20442bfeb24",
              "status": "affected",
              "version": "66a0e2d579dbec5c676cfe446234ffebb267c564",
              "versionType": "git"
            },
            {
              "lessThan": "79900d978158b2d80eef952fc41b9e4dc58d7b83",
              "status": "affected",
              "version": "66a0e2d579dbec5c676cfe446234ffebb267c564",
              "versionType": "git"
            },
            {
              "lessThan": "3cde4a8302301679937474a5f7a851394cc1bd11",
              "status": "affected",
              "version": "66a0e2d579dbec5c676cfe446234ffebb267c564",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/osdmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject buckets with mismatched CRUSH ids\n\ncrush_decode() stores bucket data by array slot, and the mapper later\nderives the per-bucket workspace index from the decoded bucket id. A\nmalformed map can therefore make one bucket reuse another bucket\u0027s\nworkspace by encoding an id different from -1 - slot.\n\nFor uniform buckets, the second replica selection expands the source\nbucket\u0027s permutation into that aliased workspace buffer. If the source\nbucket is larger than the aliased bucket, the write runs past the smaller\npermutation array and can escape the kvmalloc\u0027d CRUSH workspace. KASAN\nreports a slab OOB write of 4 bytes in bucket_perm_choose().\n\nReject buckets whose encoded id does not match their array slot. Valid\nCRUSH maps already use the canonical negative id corresponding to the\nbucket slot, so this restores the invariant expected by\nwork-\u003ework[-1 - in-\u003eid] without changing valid map behavior."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Malformed CRUSH data arrives in CEPH_MSG_OSD_MAP over TCP from a Ceph monitor (mon_dispatch) or OSD (osd_dispatch); crush_decode() stores attacker-chosen bucket ids and crush_do_rule() later indexes the workspace from those ids with no local syscall.\nAC:L - A malicious monitor/OSD fully controls the OSD map and can encode a uniform bucket whose id aliases a smaller bucket\u0027s permutation buffer; the second replica expansion in bucket_perm_choose() then deterministically writes past the kvmalloc\u0027d CRUSH workspace without races or rare configs.\nPR:N - The attacker acts as the remote Ceph cluster peer delivering a forged osdmap to an already-connected kernel CephFS/RBD client and needs no local account, capabilities, or user-namespace privileges on the victim host.\nUI:N - Once a kernel Ceph client session exists, osdmap updates are applied automatically and scan_requests/kick_requests call calc_target()/crush_do_rule() without any further mount, open, or other victim interaction at exploit time.\nS:U - The out-of-bounds write corrupts kernel heap on the host running the Ceph client (the CRUSH workspace and adjacent kvmalloc memory), remaining in that kernel security domain rather than crossing a VM, container sandbox, or IOMMU boundary.\nC:H - Aliasing a large uniform bucket onto a smaller permutation array performs an attacker-sized slab out-of-bounds write into adjacent kernel heap, which can be leveraged as a memory-corruption primitive for arbitrary kernel reads and information disclosure.\nI:H - bucket_perm_choose() writes the source bucket\u0027s permutation past the aliased workspace into adjacent kvmalloc memory, giving a kernel heap out-of-bounds write that can be used for control-flow hijacking and arbitrary code execution.\nA:H - The slab out-of-bounds write reported by KASAN in bucket_perm_choose() can fault on unmapped adjacent memory or corrupt heap metadata, triggering a kernel oops or panic and complete loss of availability on affected Ceph client hosts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:01:50.256Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ee59040d6ed1a5f8d10d27174b8f32c90ca8e89a"
        },
        {
          "url": "https://git.kernel.org/stable/c/baad5875fdd2f5e248250fc3519bb045d64f1716"
        },
        {
          "url": "https://git.kernel.org/stable/c/4aeb93daadf388e72073abc204312dd364eeb30a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e5c6ce252b1eccfd41670a5cf95ab44f7ba7022"
        },
        {
          "url": "https://git.kernel.org/stable/c/3516a4131c4e45d62ee4e42e82c36930e8c1fbbd"
        },
        {
          "url": "https://git.kernel.org/stable/c/00562ccd4e88d092b9b851df50fad20442bfeb24"
        },
        {
          "url": "https://git.kernel.org/stable/c/79900d978158b2d80eef952fc41b9e4dc58d7b83"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cde4a8302301679937474a5f7a851394cc1bd11"
        }
      ],
      "title": "libceph: reject buckets with mismatched CRUSH ids",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89656",
    "datePublished": "2026-09-11T19:45:45.483Z",
    "dateReserved": "2026-09-11T19:38:34.743Z",
    "dateUpdated": "2026-09-14T12:01:50.256Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-QWCM-8GH9-XC6H

CVE-2026-89656 (GCVE-0-2026-89656)

Tags

Sightings

Nomenclature